>From the /etc/pam.d/passwd file on each Linux client (this works, maybe more than you want/need)
password required pam_cracklib.so difok=0 minlen=8 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 type= retry=4 Ted Lewis (518-473-1104) VM & z/Linux NYS Office for Technology -----Original Message----- From: Linux on 390 Port [mailto:[EMAIL PROTECTED] On Behalf Of Peter E. Abresch Jr. - at Pepco Sent: Monday, April 18, 2005 2:49 PM To: [email protected] Subject: Re: pam_cracklib.so questions Thanks for replying. I can enter passwords without a digit or a uppercase letter with that setup. Also, it does not count them if they are in the beginning or end. The only cracklib parameters that seem to work are retry=3 and type=linux. All the other cracklib parms seem to be ignored. Peter "Kohrs, Steve" <[EMAIL PROTECTED]> Sent by: Linux on 390 Port <[email protected]> 04/18/2005 02:33 PM Please respond to Linux on 390 Port <[email protected]> To [email protected] cc Subject Re: pam_cracklib.so questions Here's my /etc/pam.d/passwd: #%PAM-1.0 auth required pam_unix2.so nullok account required pam_unix2.so password requisite pam_passwdqc.so ask_oldauthtok=update check_oldauthtok enforce=none min=8 password required pam_pwcheck.so use_first_pass use_authtok password required pam_unix2.so use_first_pass use_authtok #password required pam_make.so /var/yp session required pam_unix2.so I'm using pam_passwdqc.so and this lists the ability to do what you're looking for too. /usr/share/doc/packages/pam/modules/README.pam_passwdqc-0.6 You've got me question whether or not I'm complying with our security standards. They are the same as yours. I haven't touched this stuff for over a year, when I set up the first server for cloning. On Mon, 2005-04-18 at 13:02, Peter E. Abresch Jr. - at Pepco wrote: > I tried the debug but get no messages. > > Peter > > > > "Kohrs, Steve" <[EMAIL PROTECTED]> > Sent by: Linux on 390 Port <[email protected]> > 04/18/2005 01:48 PM > Please respond to > Linux on 390 Port <[email protected]> > > > To > [email protected] > cc > > Subject > Re: pam_cracklib.so questions > > > > > > > Try the 'debug' option. > > /usr/share/doc/packages/pam/modules/README.pam_cracklib > > > > On Mon, 2005-04-18 at 12:30, Peter E. Abresch Jr. - at Pepco wrote: > > I have a requirement to strengthen our Linux passwords on SuSE Linux > > SLES8. Our requirement are: > > > > Password length 8 > > At least one digit > > At least on uppercase letter > > > > There are other requirements, but I cannot even get this to work. Our > > /etc/pam.d/passwd is: > > > > #%PAM-1.0 > > auth required pam_unix2.so nullok > > account required pam_unix2.so > > password requisite pam_cracklib.so retry=3 minlen=8 lcredit=0 > > ucredit=-1 dcredit=-1 ocredit=0 type=Linux > > password required pam_pwcheck.so nullok remember=5 use_authok > > password required pam_unix2.so nullok use_authtok > > session required pam_unix2.so > > > > The pam_cracklib just does not seem to be working. Does anyone have any > > ideas? Thanks > > > > ---------------------------------------------------------------------- > For LINUX-390 subscribe / signoff / archive access instructions, > send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or > visit > http://www.marist.edu/htbin/wlvindex?LINUX-390 > > > This Email message and any attachment may contain information that is > proprietary, legally privileged, confidential and/or subject to copyright > belonging to Pepco Holdings, Inc. or its affiliates ("PHI"). This Email is > intended solely for the use of the person(s) to which it is addressed. If > you are not an intended recipient, or the employee or agent responsible for > delivery of this Email to the intended recipient(s), you are hereby notified > that any dissemination, distribution or copying of this Email is strictly > prohibited. If you have received this message in error, please immediately > notify the sender and permanently delete this Email and any copies. PHI > policies expressly prohibit employees from making defamatory or offensive > statements and infringing any copyright or any other legal right by Email > communication. PHI will not accept any liability in respect of such > communications. > > ---------------------------------------------------------------------- > For LINUX-390 subscribe / signoff / archive access instructions, > send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit > http://www.marist.edu/htbin/wlvindex?LINUX-390 > ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 This Email message and any attachment may contain information that is proprietary, legally privileged, confidential and/or subject to copyright belonging to Pepco Holdings, Inc. or its affiliates ("PHI"). This Email is intended solely for the use of the person(s) to which it is addressed. If you are not an intended recipient, or the employee or agent responsible for delivery of this Email to the intended recipient(s), you are hereby notified that any dissemination, distribution or copying of this Email is strictly prohibited. If you have received this message in error, please immediately notify the sender and permanently delete this Email and any copies. PHI policies expressly prohibit employees from making defamatory or offensive statements and infringing any copyright or any other legal right by Email communication. PHI will not accept any liability in respect of such communications. ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
