Home » Linux

Managing Password Policies On Linux

Tuesday, July 26, 2011

There are a few different ways you can manage the password policies on you system.

Step 1. Look at the /etc/login.defs file, which controls password length, age, and expiration:

You can use the pam_cracklib and pam_passwdqc modules to enforce password length and complexity. Already defined by default as part of the password requirements, the pam_cracklib module can be changed to in corporate stricter requirement.

Step 2. View the current pam_cracklib policy:

You can additional parameters to increase (or decrease) the complexity and length of the password. You can gain “credit points” by using complexity within your password. Here are the available configuration options:

minlen Controls the minimum password length (default is 6)

retry Specifies the number of times to retry before an error is issued

difok Specifies the number of character that need to be different between password changes (default is 5)

dcredit Credit for digits in password (default is 1)

ucredit Credit for uppercase letters in password (default is 1)

lcredit Credit for lowercase letters in password (default is 1)

ocredit Credit for special characters in password (default is 1)

You need to back up password-auth file before you start to adjust anything in password policy.

Have fun!