Skip to Content.
Sympa Menu

unclug - Re: [unclug] question on Unix shell account password pattern enforcement

unclug AT lists.ibiblio.org

Subject: UNC Linux Users Group

List archive

Chronological Thread  
  • From: "Greenwood, Liam" <liam AT unc.edu>
  • To: UNC Linux Users Group <unclug AT lists.ibiblio.org>
  • Subject: Re: [unclug] question on Unix shell account password pattern enforcement
  • Date: Thu, 20 Jun 2013 16:36:48 +0000

ITS security runs an RSA 2-factor authentication infrastructure - you may wish to reach out to them and see if that is something that would work for you.

Cheers, Liam

On Jun 20, 2013, at 11:56 AM, "White, Douglas F" <dfwhite AT unc.edu>
 wrote:

Hello ,

 

I’m looking for suggestions for a good way to enforce several of the campus password policies for Unix shell accounts for system administrators.  These accounts must have passwords changed every thirty days and must have different passwords than the system administrator’s Onyen account.  Most of the policies are fairly easy to implement, however forcing the passwords to meet specific character patterns seems a little more challenging.  The policies require passwords to contain at least one of the following characters: !@#$%&*+={}?<>"', they must not start with a hyphen, end with a backslash (\), and start or end with a space or contain a double-quote (") anywhere except as the last character.  I have no problem creating a simple script which uses regular expressions to match these conditions; however I can’t find a place to easily call this script in Linux PAM.   I know that pam_passwdqc can be configured to only allow passwords containing all four character classes (digits, lower-case letters, upper-case letters, and other characters), to require passwords to have a minimum of a certain number of characters and to support a variety of other options and I also know that an external script can be called using pam_exec during authentication but pam_exec does not appear to support calling an external script during password changes.  A non-PAM solution may also be out there but I haven’t had any luck finding one using Google.  I could force the accounts to be campus Kerberos-based which I believe would enforce all the rules, but since system administrator accounts should be separate from regular user accounts, that solution wouldn’t meet campus policies anyway.  There may be some other obvious solution I haven’t thought of, so any help offered would be greatly appreciated.

 

Thanks,
Doug White
System Administrator
School of Education

 

_______________________________________________
unclug mailing list
unclug AT lists.ibiblio.org
We are dedicated to a harassment-free linux education and sharing experience for everyone. Our anti-harassment policy can be found at:http://lists.ibiblio.org/mailman/listinfo/unclug




Archive powered by MHonArc 2.6.24.

Top of Page