UNC Linux Users Group

["White, Douglas F" <dfwhite AT unc.edu>]

Also I rechecked the security policies and even with two-factor authentication, all the complexity rules still appear to apply.

From: <White>, Doug White <dfwhite AT unc.edu>
Date: Thursday, June 20, 2013 12:42 PM
To: UNC Group <unclug AT lists.ibiblio.org>
Subject: RE: [unclug] question on Unix shell account password pattern enforcement

I’ve thought about the token auth option but since we have little money I want to explore other options first.  Also I am using pam_passwdqc rather than pam_cracklib since it is a newer module and superceded pam_cracklib for most situations (e.g. see http://www.techrepublic.com/article/enforce-strong-passwords-with-pampasswdqc/6111316).  We may have to go the token auth route.  Does pam_cracklib have some additional features not available with pam_passwdqc?

 

 

 

 

From: unclug-bounces AT lists.ibiblio.org [mailto:unclug-bounces AT lists.ibiblio.org] On Behalf Of Palmer, Cristóbal
Sent: Thursday, June 20, 2013 12:19 PM
To: UNC Linux Users Group
Subject: Re: [unclug] question on Unix shell account password pattern enforcement

 

On Jun 20, 2013, at 11:56 AM, "White, Douglas F" <dfwhite AT unc.edu> wrote: 

I’m looking for suggestions for a good way to enforce several of the campus password policies

Are you sure all the same password complexity policies apply to you? Could you not just do a length enforcement and enforce rotation with chage and be done? Assuming you need all the full complexity, I think you need to read up on cracklib (eg. http://www.deer-run.com/~hal/sysadmin/pam_cracklib.html) and maybe post back to this list when you think you've got it.

 

In an ideal world for these systems you'd have funding to set up RSA token auth and you'd more than meet the requirement for password changes, since 60 seconds is considerably less time than 30 days. You could then have people log in with their onyens to those hosts, since what they're using to authenticate is their RSA token and not their onyen password.

 

Please note that I do not set or closely track security policy and the above is my (possibly highly flawed) interpretation of current policy. That said, it wouldn't hurt to ping the Security office and see if what I've suggested check out. Assuming you have a budget for tokens for the admins, of course.

 

Cheers,

--

Cristóbal Palmer

Systems Administrator with Open Systems

University of North Carolina at Chapel Hill

440 W. Franklin St. Chapel Hill, NC 27599-1150