CentOS 6
Set Password Rules
2011/07/11
 
Set Password Policy to let users Comply rules.
[1] Set number of days for password Expiration. Users must change their password within the days.
This setting impact only when creating a user, not impact to exisiting users.
If set to exisiting users, run the command "chage -M (days) (user)".
[root@dlp ~]#
vi /etc/login.defs
# line 17: set 60 for Password Expiration

PASS_MAX_DAYS
60
[2] Set Minimum number of days available of password.
Users must use their password at least this days after changing it.
This setting impact only when creating a user, not impact to exisiting users.
If set to exisiting users, run the command "chage -m (days) (user)".
[root@dlp ~]#
vi /etc/login.defs
# line 18: set 2 for Minimum number of days available

PASS_MIN_DAYS
2
[3] Set number of days for warnings before expiration.
This setting impact only when creating a user, not impact to exisiting users.
If set to exisiting users, run the command "chage -W (days) (user)".
[root@dlp ~]#
vi /etc/login.defs
# line 20: set 7 for number of days for warnings

PASS_WARN_AGE
7
[4] Limit using a password that was used in past.
Users can not set the same password within the generation.
[root@dlp ~]#
vi /etc/pam.d/system-auth
# near line 16: prohibit to use the same password for 5 generation in past

password
sufficient
pam_unix.so sha512 shadow nullok try_first_pass use_authtok \

 
remember=5
[5] Set minimum password length.
Users can not set thier password length less than set this parameter. ( minlen=N )
This setting linkages to other settings, so it need to set other settings like below.
[root@dlp ~]#
vi /etc/pam.d/system-auth
# near line 15: set 8 for minimum password length

password
requisite
pam_cracklib.so try_first_pass retry=3 type= \

 
minlen=8 dcredit=0 ucredit=0 lcredit=0 ocredit=0
[6] In addition to the setting above, Set dcredit that forces users to include numbers in their password. ( dcredit=-N )
[root@dlp ~]#
vi /etc/pam.d/system-auth
# near line 15: require to include 2 numbers in users password

password
requisite
pam_cracklib.so try_first_pass retry=3 type= \

 
minlen=8 dcredit=-2 ucredit=0 lcredit=0 ocredit=0
[7] In addition to the setting above, Set ucredit that forces users to include Capital characters in their password. ( ucredit=-N )
[root@dlp ~]#
vi /etc/pam.d/system-auth
# near line 15: require to include 1 capital character

password
requisite
pam_cracklib.so try_first_pass retry=3 type= \

 
minlen=8 dcredit=-2 ucredit=-1 lcredit=0 ocredit=0
[8] In addition to the setting above, Set lcredit that forces users to include Lower cases in their password. ( lcredit=-N )
[root@dlp ~]#
vi /etc/pam.d/system-auth
# near line 15: require to include 1 Lower case

password
requisite
pam_cracklib.so try_first_pass retry=3 type= \

 
minlen=8 dcredit=-2 ucredit=-1 lcredit=-1 ocredit=0
[9] In addition to the setting above, Set ocredit that forces users to include Symbols in their password. ( ocredit=-N )
[root@dlp ~]#
vi /etc/pam.d/system-auth
# near line 15: require to include 1 Symbol

password
requisite
pam_cracklib.so try_first_pass retry=3 type= \

 
minlen=8 dcredit=-2 ucredit=-1 lcredit=-1 ocredit=-1
[10] Set difok that forces more than N words in password before change are different from the one after change. ( difok=N )
[root@dlp ~]#
vi /etc/pam.d/system-auth
# near line 15: require at least 3 words are different from before change

password
requisite
pam_cracklib.so try_first_pass retry=3 type=
difok=3
[11] Set number of login failure. Users' account will be locked after failing to login without a break.
[root@dlp ~]#
vi /etc/pam.d/system-auth
# add like follows ( this example sets login failure for 5 times. ( deny=5 ) )

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth
required
pam_env.so

auth
required
pam_tally2.so deny=5

auth
sufficient
pam_fprintd.so

auth
sufficient
pam_unix.so nullok try_first_pass

auth
requisite
pam_succeed_if.so uid >= 500 quiet

auth
required
pam_deny.so
account
required
pam_unix.so

account
required
pam_tally2.so

account
sufficient
pam_localuser.so

account
sufficient
pam_succeed_if.so uid < 500 quiet

account
required
pam_permit.so
# make sure the number of failure of login about a user

[root@dlp ~]#
pam_tally2 -u cent

Login
Failures
Latest failure
From

cent
7
04/27/11 13:10:26
ttyS0
# unlock a locked user

[root@dlp ~]#
pam_tally2 -r -u cent

[12] Change password encryption algorithm.
This setting impact only when creating a user, not impact to exisiting users.
If set to exisiting users, run the command "chage -d 0 (user)" and let us change their password forcely on next login.
# make sure current algorithm

[root@dlp ~]#
authconfig --test | grep hashing

password hashing algorithm is md5
# chnage algorithm to sha512

[root@dlp ~]#
authconfig --passalgo=sha512 --update
[root@dlp ~]#
authconfig --test | grep hashing

password hashing algorithm is sha512
 
Tweet