topic Re: control the password in Operating System - Linux

control the password

juno2 — Mon, 13 Oct 2003 01:16:20 GMT

when I install the RH linux , I 've set to use the default setting to control the user can't use a specific password eg. too simple , the word in dictionary , the password has been used previously, how can I disable this control so that users can use the password the password they want ? thx.

Re: control the password

Jerome Henry — Mon, 13 Oct 2003 01:46:08 GMT

2 steps :

- Uninstall cracklib.
- Solve your points assignment issue...

Tks

J

Re: control the password

juno2 — Mon, 13 Oct 2003 02:08:10 GMT

thx reply,

could you advise how to "Uninstall cracklib" ? is there other more simple method ? thx.

Re: control the password

Steven E. Protter — Mon, 13 Oct 2003 02:08:58 GMT

The default behavior of Red Hat Linux, from my esperience v 6-v9 is to warn the root user and prevent other users from using illegal passwords.

This is a good thing.

Anyone thats telling you to remove this functionality is telling you to make your systems insecure.

If you run crack against a password file not protected this way, it will guess passwords. I ran crack against a HP-UX non-trusted system and it guessed a dozen passwords out of 160 users.

In other words, not good.

You can the rpm command to uninstall the cracklib.

rpm -q cracklib
gets you the version number. Then you can use rpm to uninstall.

I totally agree with Jerome's comments. You are a heavy user here. Please show a wee bit more respect to the community that answers your questions.

It beats paying for help right?

SEP

Re: control the password

juno2 — Mon, 13 Oct 2003 02:27:49 GMT

thx reply,

what is the impact to uninstall cracklib
? it will only disable to control the password or more ? if not , is there other method to fix the problem ? Thx.

sorry , i know i need to assign pts , I will do it within two days .

Re: control the password

juno2 — Mon, 13 Oct 2003 02:34:00 GMT

instead of uninstall the cracklib , can fix the problem by the existing tools , eg. webmin or others ? thx.

Re: control the password

Vitaly Karasik_1 — Mon, 13 Oct 2003 03:33:15 GMT

to remove pam_cracklib string from /etc/pam.d/system-auth ?

Re: control the password

Jerome Henry — Mon, 13 Oct 2003 04:49:46 GMT

It's not exactly a 'problem', as Steven explains (hey, don't you sleep, Steven ?).
By default, the system protects from weak password, from the line Vitaly quotes, if you use pam, and using cracklib as a weak password database.
If you want to stop this feature, you can unactivate this check from pam module, or uninstall database (so no weak password anymore).
The only thing you can do from webmin is, under pam authentification, uncheck login, such no requiring pam for login, which is definetely a bad idea.

J

Re: control the password

Huc_1 — Mon, 13 Oct 2003 06:18:07 GMT

You seem to have lot of problem with password lately, but dont turn to such drastic methode
I will join the crowed and advice again it !
keep the history file active.

Dont let your user/management impose this, explain/defend to them that this is against everyone interest.

If the task of keeping up is hard and you need more information on password management, take the time to read the following link I have found this read to be time well spend.

http://www.redhat.com/docs/manuals/linux/RHL-9-Manual/security-guide/s1-wstation-pass.html

Keep at it !

J-P

"Jolie couvre chef sir Jerome Henry" (french --> means something like "nice hat on your head mylord Jerome Henry).

Re: control the password

Martin P.J. Zinser — Mon, 13 Oct 2003 09:22:19 GMT

Also note that removing these additional checks will not solve the issues of locking when two different users try to change their passwords at the same time.

Re: control the password

Huc_1 — Wed, 15 Oct 2003 06:43:25 GMT

Any feed back progress /yet on this issue?
still a problem?

J-P

Re: control the password

aparna challagulla — Wed, 15 Oct 2003 07:24:24 GMT

hi juno,
considering all ur past posts regarding passwd and chage i think u want password aging enabled for ur users. i also remember u saying that u have nearly 200 users.
whenever a user tries to change his/her password the /etc/passwd file is locked and the lock is only released after the changes are saved. i dont think u can disable this feature or if there a workaround for it.
try enabling aging for a batch of users each day so that all users dont try to do it simultaneously.
or else dont enable password aging for the same number of days for all users.
HTH
aparna

P.S. would like to know how/whenever u solve this issue.