Pages

Saturday, November 7, 2015

Enforce Password Complexity in Linux Server

You can use PAM to enforce password complexity in Linux Systems. For Debian / Ubuntu you can use the following file:
/etc/pam.d/common-password


First install the package.
apt-get install libpam-cracklib


Edit "/etc/pam.d/common-password" as per your requirement.

password requisite pam_cracklib.so try_first_pass retry=3 minlength=6 lcredit=1 ucredit=1 dcredit=0 ocredit=1 difok=4

** try_first_pass retry=3 [Number of times to password change retry]
** minlength = 6 [Minimum password length is 6]
** lcredit =1 [Minimum lowercase character is 1]
** ucredit = 1 [Minimum uppercase character is 1]
** dcredit = 0 [Minimum number is 0]
** ocredit = 1 [Minimum number of other character / simbols is 1]
** difok = 4 [New password must be different from previous 4 passwords]


Now modify the options as you need. You can omit options like below.
password requisite pam_cracklib.so try_first_pass retry=3 minlength=6 ucredit=1 dcredit=1 


Save the file and you are done.