UNC Linux Users Group

["White, Douglas F" <dfwhite AT unc.edu>]

Thanks – That is probably the way I’ll have to go but I wanted to check and see if I anyone had implemented the policies using Linux PAM first.

 

 

Doug

 

From: unclug-bounces AT lists.ibiblio.org [mailto:unclug-bounces AT lists.ibiblio.org] On Behalf Of Greenwood, Liam
Sent: Thursday, June 20, 2013 12:37 PM
To: UNC Linux Users Group
Subject: Re: [unclug] question on Unix shell account password pattern enforcement

 

ITS security runs an RSA 2-factor authentication infrastructure - you may wish to reach out to them and see if that is something that would work for you.

 

Cheers, Liam

 

On Jun 20, 2013, at 11:56 AM, "White, Douglas F" <dfwhite AT unc.edu>

 wrote:

Hello ,

 

I’m looking for suggestions for a good way to enforce several of the campus password policies for Unix shell accounts for system administrators.  These accounts must have passwords changed every thirty days and must have different passwords than the system administrator’s Onyen account.  Most of the policies are fairly easy to implement, however forcing the passwords to meet specific character patterns seems a little more challenging.  The policies require passwords to contain at least one of the following characters: !@#$%&*+={}?<>"', they must not start with a hyphen, end with a backslash (\), and start or end with a space or contain a double-quote (") anywhere except as the last character.  I have no problem creating a simple script which uses regular expressions to match these conditions; however I can’t find a place to easily call this script in Linux PAM.   I know that pam_passwdqc can be configured to only allow passwords containing all four character classes (digits, lower-case letters, upper-case letters, and other characters), to require passwords to have a minimum of a certain number of characters and to support a variety of other options and I also know that an external script can be called using pam_exec during authentication but pam_exec does not appear to support calling an external script during password changes.  A non-PAM solution may also be out there but I haven’t had any luck finding one using Google.  I could force the accounts to be campus Kerberos-based which I believe would enforce all the rules, but since system administrator accounts should be separate from regular user accounts, that solution wouldn’t meet campus policies anyway.  There may be some other obvious solution I haven’t thought of, so any help offered would be greatly appreciated.

 

Thanks,

Doug White

System Administrator

School of Education

 

_______________________________________________
unclug mailing list
unclug AT lists.ibiblio.org
We are dedicated to a harassment-free linux education and sharing experience for everyone. Our anti-harassment policy can be found at:http://lists.ibiblio.org/mailman/listinfo/unclug