Password Complexity Question

[Jeff Ohlhausen]

Hi,
We are changing lots of passwords to comply with password complexity requirements. However, I know there are certain characters which are not acceptable for O/S users. In fact, in the passwd man page there is the following statement:
Care must be taken not to include the system default erase or kill characters. passwd will reject any password which is not suitably complex.

Can anyone tell me:
a) what those characters are
b) evidence to support this

Thanks
Jeff

[Rick Garland]

A couple of these special characters are * and !.

Linux uses the /etc/shadow file to store the passwds. An example of the * character is that it is used to denote a disabled/locked acct.

An example of the ! character is if you use the commands 'passwd -l' or 'usermod -L'. This will place the ! character in front of the encrypted passwd effectively locking/disabling the acct.

There is also the configuration of the pam module that will allow/disallow certain characters. You can define this to be loose or tight, however you want.

With the pam_cracklib module you can enforce various restrictions.

[Ross Minkov]

Jeff,

Read the Linux-PAM System Administrators' Guide by Andrew G. Morgan at:

http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam.html

-Ross

[Jeff Ohlhausen]

Everyone,
Thank you for your help so far but we still haven't really answered the original question.
1. Where can I get a list of 'bad' characters
Thanks
Jeff

[Ranjith_5 · Accepted solution]

Hi Jeff,

he other 2 cases of special case characters are "@" and "#". But the problem is only occurs when you use a telnet session. In an SSH session none of these characters causes problems. In telnet session you can use "\" just before '@" ot "#". Normally in other unixes I havent faced problems with "!" character. "!" is found to be taken as a normal charactersbut not the other two.For example assume your password is P@ssw0rd!23.
Here you can disable the special case of "@" bye using "P\@ssw0rd!23".

I have a tried this in HP-UX.


Regards,
Syam