0

I am configuring password rules in linux system(RedHat Enterprise linux 5). By google, I found that using pam_cracklib will make simple check automatically. That is, pam_cracklib will automatically check if the new password is the reverse one of the previous password. If yes, it will reject the new password.

However, I tried a new password just the reverse of the previous one, the new password can take effective! That is, pam_cracklib will allow the new password(reverse of the previous one). Here is my configuration:

/etc/pam.d/system-auth:
password    required    pam_cracklib.so try_first_pass retry=3  minlen=6 

Could anyone tell me if there is something wrong with my configuration? Or there are some bugs with pam_cracklib?

Thanks a lot!

3
  • Did you try to change the password as root or as a regular user? root can override all kinds of restrictions in many situations. Sep 28, 2010 at 7:20
  • Janne, I change password as a regular user, not root.So I am surprised why pam_cracklib doesn't take effective.
    – zhaojing
    Sep 28, 2010 at 7:40
  • adding "obscure" to pam_cracklib will have similar effect Aug 16, 2011 at 21:12

1 Answer 1

0

You can't use try_first_pass with cracklib. It should check whatever the password is a palindrome or rotation of old password by default.

What's more, other modules (probably pam_unix.so or pam_ldap.so) in the stack must use the use_authok flag or they will be allowed to ask the user for password if previous module didn't accept the provided password.

In short, try:

password    required    pam_cracklib.so retry=3  minlen=6
password    required    pam_unix.so use_authok nullok md5

The nullok flag tells the module it's OK to change password from an empty one (the usual method of forcing a password change in UNIX systems), you can remove it if you don't use this functionality.

10
  • But It seems the method you proposed still can't solve the problem.
    – zhaojing
    Sep 30, 2010 at 2:45
  • For example, if I first set passwd:1qaz2wsx, the second I set passwd:xsw2zaq1. It works. So the rotation checking seems doesn't take effective.
    – zhaojing
    Sep 30, 2010 at 2:46
  • The palindrome is just for a new password (you can't have a "qwertrewq" password). Rotation checks only for simple word rotation, as when you start a word in the middle and add the start to the end: so with old password "password", the new password can't be "sswordpa" or "wordpass". As such, I don't think you should worry about this combination, it's rather obscure. Anyway, you may be interested in discussion in serverfault.com/questions/4221/…. Sep 30, 2010 at 8:02
  • Hobert, thanks a lot for your help and your suggested webpage.
    – zhaojing
    Sep 30, 2010 at 8:40
  • In fact, the information by google makes me confused.
    – zhaojing
    Sep 30, 2010 at 8:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .