UNC Linux Users Group

[Palmer, Cristóbal <cmpalmer AT email.unc.edu>]

On Jun 20, 2013, at 11:56 AM, "White, Douglas F" <dfwhite AT unc.edu> wrote: 

I’m looking for suggestions for a good way to enforce several of the campus password policies

Are you sure all the same password complexity policies apply to you? Could you not just do a length enforcement and enforce rotation with chage and be done? Assuming you need all the full complexity, I think you need to read up on cracklib (eg. http://www.deer-run.com/~hal/sysadmin/pam_cracklib.html) and maybe post back to this list when you think you've got it.

In an ideal world for these systems you'd have funding to set up RSA token auth and you'd more than meet the requirement for password changes, since 60 seconds is considerably less time than 30 days. You could then have people log in with their onyens to those hosts, since what they're using to authenticate is their RSA token and not their onyen password.

Please note that I do not set or closely track security policy and the above is my (possibly highly flawed) interpretation of current policy. That said, it wouldn't hurt to ping the Security office and see if what I've suggested check out. Assuming you have a budget for tokens for the admins, of course.

Cheers,

--

Cristóbal Palmer

Systems Administrator with Open Systems

University of North Carolina at Chapel Hill

440 W. Franklin St. Chapel Hill, NC 27599-1150