Skip to Content.
Sympa Menu

unclug - Re: [unclug] question on Unix shell account password pattern enforcement

unclug AT lists.ibiblio.org

Subject: UNC Linux Users Group

List archive

Chronological Thread  
  • From: Palmer, Cristóbal <cmpalmer AT email.unc.edu>
  • To: UNC Linux Users Group <unclug AT lists.ibiblio.org>
  • Subject: Re: [unclug] question on Unix shell account password pattern enforcement
  • Date: Thu, 20 Jun 2013 16:18:36 +0000

On Jun 20, 2013, at 11:56 AM, "White, Douglas F" <dfwhite AT unc.edu> wrote: 

I’m looking for suggestions for a good way to enforce several of the campus password policies

Are you sure all the same password complexity policies apply to you? Could you not just do a length enforcement and enforce rotation with chage and be done? Assuming you need all the full complexity, I think you need to read up on cracklib (eg. http://www.deer-run.com/~hal/sysadmin/pam_cracklib.html) and maybe post back to this list when you think you've got it.

In an ideal world for these systems you'd have funding to set up RSA token auth and you'd more than meet the requirement for password changes, since 60 seconds is considerably less time than 30 days. You could then have people log in with their onyens to those hosts, since what they're using to authenticate is their RSA token and not their onyen password.

Please note that I do not set or closely track security policy and the above is my (possibly highly flawed) interpretation of current policy. That said, it wouldn't hurt to ping the Security office and see if what I've suggested check out. Assuming you have a budget for tokens for the admins, of course.

Cheers,
--
Cristóbal Palmer
Systems Administrator with Open Systems
University of North Carolina at Chapel Hill
440 W. Franklin St. Chapel Hill, NC 27599-1150




Archive powered by MHonArc 2.6.24.

Top of Page