Sahyog password policy

2017-11-23T10:20:59Z

Dilip: Created page with "Appendix E – Password requirements. 1. Users must change password at least once every 90 days. 2. Passwords must have minimum length of 7 characters. 3. Passwords must cont..."

Appendix E – Password requirements.

1. Users must change password at least once every 90 days.
2. Passwords must have minimum length of 7 characters.
3. Passwords must contains alpha-numeric and special characters.
4. New passwords cannot be the same as the four previously used passwords.
5. A user’s account must be locked out after not more than six invalid logon attempts.
6. Once a user account is locked out, it must remain locked for a minimum of 30 minutes or until a system administrator resets the account.

Public IP

ssh 182.73.247.53 -l root -v

======================
[1] user’s account must be locked out after not more than six invalid logon attempts

vi /etc/pam.d/system-auth

account required pam_tally2.so

auth required pam_tally2.so file=/var/log/tallylog deny=5 even_deny_root unlock_time=1800 root_unlock_time=1800

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done,
192.168.100.26 done,192.168.100.22 done

======================

[2] Set number of days for password Expiration.
Users must change their password within the days.
This setting impacts only when creating a user, not impacts to exisiting users.
If set to exisiting users, run the command "chage -M (days) (user)".

[root@dlp ~]# vi /etc/login.defs
# line 25: set 90 for Password Expiration
PASS_MAX_DAYS 90

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done,
192.168.100.26 done,192.168.100.22 done

==========================

[3] Set number of days for warnings before expiration.
This setting impacts only when creating a user, not impacts to exisiting users.
If set to exisiting users, run the command "chage -W (days) (user)".

[root@dlp ~]# vi /etc/login.defs
# line 28: set 7 for number of days for warnings
PASS_WARN_AGE 7

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done,
192.168.100.26 done,192.168.100.22 done

============================

[4] Limit using a password that was used in past.
Users can not set the same password within the generation.

[root@dlp ~]# vi /etc/pam.d/system-auth
# near line 15: prohibit to use the same password for 4 generation in past
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=4

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done,
192.168.100.26 done,192.168.100.22 done

=============================

[5] Set minimum password length.
Users can not set thier password length less than this parameter.

# set 8 for minimum password length
[root@dlp ~]# authconfig --passminlen=7 --update
# the parameter is set in a config below
[root@dlp ~]# grep "^minlen" /etc/security/pwquality.conf
minlen = 7

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done,
192.168.100.26 done,192.168.100.22 done

============================

[6] Set minimum number of required classes of characters for the new password. (kinds ⇒ UpperCase / LowerCase / Digits / Others)

# set 2 for minimum number of required classes of characters
[root@dlp ~]# authconfig --passminclass=2 --update
# the parameter is set in a config below
[root@dlp ~]# grep "minclass" /etc/security/pwquality.conf
minclass = 2

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done,
192.168.100.26 done,192.168.100.22 done

===============================

[7] Require at least one lowercase character in the new password.

[root@dlp ~]# authconfig --enablereqlower --update
# the parameter is set in a config below
# (if you'd like to edit the value, edit it with vi and others)
[root@dlp ~]# grep "^lcredit" /etc/security/pwquality.conf
lcredit = -1

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done,
192.168.100.26 done,192.168.100.22 done

================================

[8] Require at least one uppercase character in the new password

[root@dlp ~]# authconfig --enablerequpper --update
# the parameter is set in a config below
# (if you'd like to edit the value, edit it with vi and others)
[root@dlp ~]# grep "^ucredit" /etc/security/pwquality.conf
ucredit = -1

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done,
192.168.100.26 done,192.168.100.22 done

=================================

[9] Require at least one digit in the new password
[root@dlp ~]# authconfig --enablereqdigit --update
# the parameter is set in a config below
# (if you'd like to edit the value, edit it with vi and others)
[root@dlp ~]# grep "^dcredit" /etc/security/pwquality.conf
dcredit = -1

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done,
192.168.100.26 done,192.168.100.22 done

=========================================================================

[10] Require at least one other character in the new password.
[root@dlp ~]# authconfig --enablereqother --update
# the parameter is set in a config below
# (if you'd like to edit the value, edit it with vi and others)
[root@dlp ~]# grep "^ocredit" /etc/security/pwquality.conf
ocredit = -1

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done,
192.168.100.26 done,192.168.100.22 done

===============================================

[11] Set number of characters in the new password that must not be present in the old password.
[root@dlp ~]# vi /etc/security/pwquality.conf
# add to the end
difok = 5

192.168.100.21 done, 192.168.100.25 done,192.168.100.24 done,
192.168.100.26 done,192.168.100.22 done

====================================
RHEL 5 ,192.168.100.29, 192.168.100.30 done

vi /etc/pam.d/system-auth

password requisite pam_cracklib.so try_first_pass retry=3 minlength=7 lcredit=1 ucredit=1 dcredit=1 ocredit=1 difok=5

====================================

[1] user’s account must be locked out after not more than six invalid logon attempts

vi /etc/pam.d/system-auth

account required pam_tally2.so

auth required pam_tally2.so file=/var/log/tallylog deny=5 even_deny_root unlock_time=1800 root_unlock_time=1800

password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=4

===================================
[root@dlp ~]# vi /etc/login.defs
# line 28: set 7 for number of days for warnings
PASS_WARN_AGE 7

==================================

TetraWiki - User contributions [en]

Sahyog password policy