Red Hat Security: Linux in Physical, Virtual, and Cloud

Objectives

After completing this section, students should be able to implement password quality requirements using pam_pwquality and authconfig.

Describing the pam_pwquality Module

Many organizations require user passwords to comply with a particular set of rules, which often define the password length or the type of characters to use. On Red Hat Enterprise Linux, you can use PAM to enforce these security policies and recommended practices.

PAM uses the rules in the password management group when a user attempts to change their password through an open application session. The following examples show password management group rules from files in /etc/pam.d/:

[root@demo ~]# grep ^password /etc/pam.d/sshd
password   include      password-auth

[root@demo ~]# grep ^password /etc/pam.d/login
password   include      system-auth

Notice that these two types of login session use include calls to either system-auth or password-auth. Password rules in password-auth or system-auth are identical.

Inspect the /etc/pam.d/system-auth file.

[root@demo ~]# grep ^password /etc/pam.d/system-auth
password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

Recall that PAM rules are parsed and executed top to bottom. When a user attempts to change their password, the first rule that PAM calls is the requisite pam_pwquality.so entry.

The pam_pwquality module takes the new password provided by the user, checks it against a dictionary in /usr/share/cracklib/, and checks it for patterns and easily guessed combinations. By default, this module expects passwords to be longer than six characters and a combination of upper- and lowercase letters, digits, and special characters. Because this module is called with a requisite controller, if the password is deemed not compliant, the password change immediately stops and control returns to the application which initiated the PAM call; no further PAM rules are inspected.

If the user passes the pam_pwquality check, PAM executes the sufficient pam_unix.so rule. In the password management group, pam_unix updates the user's password in a variety of back-end storage mechanisms, including /etc/passwd, /etc/shadow, or Network Information System (NIS).

Because the pam_unix rule uses the sufficient controller, if it is successful in updating the user's password, PAM closes and passes control back to the application that called it.

There is one last rule, the required pam_deny.so entry. PAM only checks this rule if the sufficient pam_unix.so rule fails for some reason to update the user's password. pam_deny always returns a failure result. This way the application knows there was an error when it called PAM. Because the pam_deny rule is required, PAM returns an overall failure to the application attempting to change the user's password.

Configuring the pam_pwquality Module

There are two ways to configure the pam_pwquality module:

The following parameters, set by default in the /etc/pam.d/system-auth and /etc/pam.d/password-auth files, cannot be specified in /etc/security/pwquality.conf. If you want to modify them, you need to edit the PAM configuration files.

The other parameters control the requirements for the password complexity. You can specify them as arguments to the pam_pwquality module in the PAM configuration files, or more conveniently in the /etc/security/pwquality.conf file.

There are many different ways to combine the different length and complexity requirements with pam_pwquality. They depend on the security policy or password policy that your machines are required to comply with.

Configuring a Password Policy with Specific Character Class Requirements

A policy that requires a specific minimum password length, with specific numbers of characters per class, is easy to configure.

Consider the following example policy:

To implement this policy, edit the /etc/security/pwquality.conf file to set the following parameters:

[root@demo ~]# vim /etc/security/pwquality.conf
minlen = 8
lcredit = 0
ucredit = -1
dcredit = -2
ocredit = -1

Negative values indicate the minimum number of characters required for each class. Even though the policy does not specify anything regarding lowercase characters, you still need to set the lcredit parameter to 0. The default value for all those credit parameters is 1, and you need to specify suitable values for all parameters or pam_pwquality will not enforce the password policy correctly.

Explaining the Credit Mechanism

Password policies such as the previous one are widespread, but they are sometimes a source of frustration for the users who have to create and remember passwords with complex combinations of different classes of characters. Another option is to force much longer passwords but with fewer character class constraints. A shorter password can even be accepted if the user voluntarily uses special characters.

The pam_pwquality credit mechanism is an implementation of that idea, and it is triggered when the credit parameters have positive values. In that situation, the minlen parameter is more like a quality level that the password must reach for the module to accept it:

If the resulting score is equal to or above minlen, then the password is accepted.

With the following /etc/security/pwquality.conf configuration file, the table below gives some examples.

[root@demo ~]# cat /etc/security/pwquality.conf
minlen = 18
lcredit = 1
ucredit = 1
dcredit = 2
ocredit = 5