Enforcing more complex passwords...

[Michael Pasquale]

Greetings,

Our client has requested that user passwords must include 3 of the following 4 types of characters: uppercase, lowercase, numbers, and special characters. However, according to the man page for passwd, only two groups are required by default (letters and either numbers or special characters).

We're running as a trusted system, and there doesn't seem to be an option in SAM. I also couldn't find an appropriate variable to add to /etc/default/security.

Can I satisfy this requirement through a configuration change, or do I need a third-party tool?

Thanks for your consideration...

~Michael Pasquale

[Jeff Schussele]

Hi Michael,

Think you can do this with a PAM - Pluggable Authentication Module.
You'd have to modify the std module, write one or purchase it.
If you do a strings | grep password on the /usr/lib/security/libpam.unix.1 file you'll see the following in the output

The password entered is not valid. Valid passwords must contain at least:

So the std module IS checking - it just has to be modified to check using your restrictions.
Maybe someone out there has already done so.
I know there are 3rd party products that will do this.

Rgds,
Jeff

[Steven Sim Kok Leong · Accepted solution]

Hi Michael,

You can try writing a passwd wrapper for it.

A rough example (you definitely need to test and finetune):

# mv /usr/bin/passwd /usr/bin/passwd.bin

# cat /usr/bin/passwd

#!/sbin/sh

stty -echo
echo "New UNIX password: \c"
read passwd
stty echo

if echo $passwd | grep [0123456789] | grep [a-zA-Z] | grep [!@#$%^&*()_+|] >/dev/null 2>&1
then
echo "This password qualifies. Proceeding..."
/usr/bin/passwd.bin $passwd
fi

Hope this helps. Regards.

Steven Sim Kok Leong

[Michael Pasquale]

Thank you both very much!!

Since enforcing such complexity is not immediately feasible (i.e., the change can't be made without additional coding/software), our client decided that this issue can wait for the time being.

Thank you both for your input; I'll investigate your suggestions.

Sincerely,
Michael Pasquale

[doug hosking]

You don't say what HP-UX release you are running, but given that you refer to /etc/default/security I will assume it's either 11.00 or 11.11.

It seems that sites have a limitless number of special requirements
for passwords. A custom PAM module is probably the 'right'
solution here, but has obvious support cost consequences.

Although I don't have a perfect solution for you, there is one simple
solution that can help meet most of your requirements. Take a look
at the documetation for patch PHCO_24390, which adds a
new feature. Unfortunately this isn't yet mentioned in the security(4)
manual pages. Quoting from the patch documentation:

A site's security policies sometimes require new passwords
to contain specific numbers or types of characters, such as
at least two digits and at least one special character.
Resolution:
In addition to the standard password requirements,
optional entries in the file /etc/default/security specify
the minimum number of required characters of each type
(upper case characters, lower case characters, digits
and special characters) in a new password.
PASSWORD_MIN_UPPER_CASE_CHARS=N
PASSWORD_MIN_LOWER_CASE_CHARS=N
PASSWORD_MIN_DIGIT_CHARS=N
PASSWORD_MIN_SPECIAL_CHARS=N
The default value for N is 0. These parameters have
effect only when a password is changed. On untrusted
systems, these parameters do not apply to the root user.
The file /etc/default/security should be owned by root and
have 0644 permissions.
As an example, to require passwords at least 8 characters
long, composed of at least 5 upper case characters, 2
lower case characters and a digit, include the following
lines in /etc/default/security, as specified above:
PASSWORD_MIN_UPPER_CASE_CHARS=5
PASSWORD_MIN_LOWER_CASE_CHARS=2
PASSWORD_MIN_DIGIT_CHARS=1