Red Hat Security: Linux in Physical, Virtual, and Cloud

Set the password policy on your system to require a password of at least 12 characters, including at least one symbol and one digit.

1. Log in to serverc as student. No password is required.

   [student@workstation ~]$ ssh student@serverc
   [student@serverc ~]$ 

2. Use the sudo -i command to switch identity to the root user. Use student as the password.

   [student@serverc ~]$ sudo -i
   [sudo] password for student: student
   [root@serverc ~]# 

3. Verify that the default PAM configuration already includes a rule to call the pam_pwquality module.

   [root@serverc ~]# cd /etc/pam.d
   [root@serverc pam.d]# grep pam_pwquality.so system-auth password-auth
   system-auth:password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
   password-auth:password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=

4. Use the authconfig --passminlen=12 --update command to set the password length.

   [root@serverc pam.d]# authconfig --passminlen=12 --update
   [root@serverc pam.d]# 

   Alternatively, you could directly edit the /etc/security/pwquality.conf configuration file.

5. To define the more advanced password requirements, edit the /etc/security/pwquality.conf file. Set the dcredit and ocredit parameters to -1. pam_pwquality uses negative values to enforce a minimum number of characters of a class.

   [root@serverc pam.d]# vim /etc/security/pwquality.conf
   ...output omitted...
   minlen = 12
   minclass = 1
   maxrepeat = 0
   maxclassrepeat = 0
   lcredit    = 0
   ucredit    = 0
   dcredit    = -1
   ocredit    = -1

Verify that you meet the new requirements by setting the student user password to:

1. Log out from the root account.

   [root@serverc pam.d]# logout
   [student@serverc ~]$ 

2. Use the passwd command to set the password for the student user.

   [student@serverc ~]$ passwd
   Changing password for user student.
   Changing password for student.
   (current) UNIX password: student
   New password: L1b3r8yourself
   BAD PASSWORD: The password contains less than 1 non-alphanumeric characters
   New password: i<3bearclaws
   Retype new password: i<3bearclaws
   passwd: all authentication tokens updated successfully.

3. Use sudo -i to become root again and change the student password back to student. If the sudo command asks for a password, use the new one.

   [student@serverc ~]$ sudo -i
   [sudo] password for student: i<3bearclaws
   [root@serverc ~]# passwd student
   Changing password for user student.
   New password: student
   BAD PASSWORD: The password is shorter than 8 characters
   Retype new password: student
   passwd: all authentication tokens updated successfully.