topic Re: Password Complexity Question in Operating System - Linux

Password Complexity Question

Jeff Ohlhausen — Mon, 15 Aug 2005 10:34:58 GMT

Hi,
We are changing lots of passwords to comply with password complexity requirements. However, I know there are certain characters which are not acceptable for O/S users. In fact, in the passwd man page there is the following statement:
Care must be taken not to include the system default erase or kill characters. passwd will reject any password which is not suitably complex.

Can anyone tell me:
a) what those characters are
b) evidence to support this

Thanks
Jeff

Re: Password Complexity Question

Rick Garland — Mon, 15 Aug 2005 11:11:09 GMT

A couple of these special characters are * and !.

Linux uses the /etc/shadow file to store the passwds. An example of the * character is that it is used to denote a disabled/locked acct.

An example of the ! character is if you use the commands 'passwd -l' or 'usermod -L'. This will place the ! character in front of the encrypted passwd effectively locking/disabling the acct.

There is also the configuration of the pam module that will allow/disallow certain characters. You can define this to be loose or tight, however you want.

With the pam_cracklib module you can enforce various restrictions.

Re: Password Complexity Question

Ross Minkov — Mon, 15 Aug 2005 12:20:40 GMT

Jeff,

Read the Linux-PAM System Administrators' Guide by Andrew G. Morgan at:

http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam.html

-Ross

Re: Password Complexity Question

Jeff Ohlhausen — Mon, 15 Aug 2005 12:26:30 GMT

Everyone,
Thank you for your help so far but we still haven't really answered the original question.
1. Where can I get a list of 'bad' characters
Thanks
Jeff

Re: Password Complexity Question

Ranjith_5 — Mon, 15 Aug 2005 12:30:19 GMT

Hi Jeff,

he other 2 cases of special case characters are "@" and "#". But the problem is only occurs when you use a telnet session. In an SSH session none of these characters causes problems. In telnet session you can use "\" just before '@" ot "#". Normally in other unixes I havent faced problems with "!" character. "!" is found to be taken as a normal charactersbut not the other two.For example assume your password is P@ssw0rd!23.
Here you can disable the special case of "@" bye using "P\@ssw0rd!23".

I have a tried this in HP-UX.

Regards,
Syam