UNC Linux Users Group

["White, Douglas F" <dfwhite AT unc.edu>]

Hello ,

 

I’m looking for suggestions for a good way to enforce several of the campus password policies for Unix shell accounts for system administrators.  These accounts must have passwords changed every thirty days and must have different passwords than the system administrator’s Onyen account.  Most of the policies are fairly easy to implement, however forcing the passwords to meet specific character patterns seems a little more challenging.  The policies require passwords to contain at least one of the following characters: !@#$%&*+={}?<>"', they must not start with a hyphen, end with a backslash (\), and start or end with a space or contain a double-quote (") anywhere except as the last character.  I have no problem creating a simple script which uses regular expressions to match these conditions; however I can’t find a place to easily call this script in Linux PAM.   I know that pam_passwdqc can be configured to only allow passwords containing all four character classes (digits, lower-case letters, upper-case letters, and other characters), to require passwords to have a minimum of a certain number of characters and to support a variety of other options and I also know that an external script can be called using pam_exec during authentication but pam_exec does not appear to support calling an external script during password changes.  A non-PAM solution may also be out there but I haven’t had any luck finding one using Google.  I could force the accounts to be campus Kerberos-based which I believe would enforce all the rules, but since system administrator accounts should be separate from regular user accounts, that solution wouldn’t meet campus policies anyway.  There may be some other obvious solution I haven’t thought of, so any help offered would be greatly appreciated.

 

Thanks,

Doug White

System Administrator

School of Education