Sahyog password policy

Appendix E – Password requirements.

1. Users must change password at least once every 90 days. 2. Passwords must have minimum length of 7 characters. 3. Passwords must contains alpha-numeric and special characters. 4. New passwords cannot be the same as the four previously used passwords. 5. A user’s account must be locked out after not more than six invalid logon attempts. 6. Once a user account is locked out, it must remain locked for a minimum of 30 minutes or until a system administrator resets the account.

Public IP

ssh 182.73.247.53 -l root -v

==========

[1] user’s account must be locked out after not more than six invalid logon attempts

vi /etc/pam.d/system-auth

account required pam_tally2.so

auth required pam_tally2.so file=/var/log/tallylog deny=5 even_deny_root unlock_time=1800 root_unlock_time=1800

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done, 192.168.100.26 done,192.168.100.22 done

==========

[2] Set number of days for password Expiration. Users must change their password within the days. This setting impacts only when creating a user, not impacts to exisiting users. If set to exisiting users, run the command "chage -M (days) (user)".

[root@dlp ~]# vi /etc/login.defs

1. line 25: set 90 for Password Expiration

PASS_MAX_DAYS 90

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done, 192.168.100.26 done,192.168.100.22 done

==============

[3] Set number of days for warnings before expiration. This setting impacts only when creating a user, not impacts to exisiting users. If set to exisiting users, run the command "chage -W (days) (user)".

[root@dlp ~]# vi /etc/login.defs

1. line 28: set 7 for number of days for warnings

PASS_WARN_AGE 7

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done, 192.168.100.26 done,192.168.100.22 done

================

[4] Limit using a password that was used in past. Users can not set the same password within the generation.

[root@dlp ~]# vi /etc/pam.d/system-auth

1. near line 15: prohibit to use the same password for 4 generation in past

password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=4

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done, 192.168.100.26 done,192.168.100.22 done

=================

[5] Set minimum password length. Users can not set thier password length less than this parameter.

1. set 8 for minimum password length

[root@dlp ~]# authconfig --passminlen=7 --update

1. the parameter is set in a config below

[root@dlp ~]# grep "^minlen" /etc/security/pwquality.conf minlen = 7

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done, 192.168.100.26 done,192.168.100.22 done

================

[6] Set minimum number of required classes of characters for the new password. (kinds ⇒ UpperCase / LowerCase / Digits / Others)

1. set 2 for minimum number of required classes of characters

[root@dlp ~]# authconfig --passminclass=2 --update

1. the parameter is set in a config below

[root@dlp ~]# grep "minclass" /etc/security/pwquality.conf minclass = 2

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done, 192.168.100.26 done,192.168.100.22 done

===================

[7] Require at least one lowercase character in the new password.

[root@dlp ~]# authconfig --enablereqlower --update

1. the parameter is set in a config below
2. (if you'd like to edit the value, edit it with vi and others)

[root@dlp ~]# grep "^lcredit" /etc/security/pwquality.conf lcredit = -1

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done, 192.168.100.26 done,192.168.100.22 done

====================

[8] Require at least one uppercase character in the new password

[root@dlp ~]# authconfig --enablerequpper --update

1. the parameter is set in a config below
2. (if you'd like to edit the value, edit it with vi and others)

[root@dlp ~]# grep "^ucredit" /etc/security/pwquality.conf ucredit = -1

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done, 192.168.100.26 done,192.168.100.22 done

=====================

[9] Require at least one digit in the new password [root@dlp ~]# authconfig --enablereqdigit --update

1. the parameter is set in a config below
2. (if you'd like to edit the value, edit it with vi and others)

[root@dlp ~]# grep "^dcredit" /etc/security/pwquality.conf dcredit = -1

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done, 192.168.100.26 done,192.168.100.22 done

=============================================================

[10] Require at least one other character in the new password. [root@dlp ~]# authconfig --enablereqother --update

1. the parameter is set in a config below
2. (if you'd like to edit the value, edit it with vi and others)

[root@dlp ~]# grep "^ocredit" /etc/security/pwquality.conf ocredit = -1

192.168.100.21 done,192.168.100.25 done,192.168.100.24 done, 192.168.100.26 done,192.168.100.22 done

===================================

[11] Set number of characters in the new password that must not be present in the old password. [root@dlp ~]# vi /etc/security/pwquality.conf

1. add to the end

difok = 5

192.168.100.21 done, 192.168.100.25 done,192.168.100.24 done, 192.168.100.26 done,192.168.100.22 done

========================

RHEL 5 ,192.168.100.29, 192.168.100.30 done

vi /etc/pam.d/system-auth

password requisite pam_cracklib.so try_first_pass retry=3 minlength=7 lcredit=1 ucredit=1 dcredit=1 ocredit=1 difok=5

========================

[1] user’s account must be locked out after not more than six invalid logon attempts

vi /etc/pam.d/system-auth

account required pam_tally2.so

auth required pam_tally2.so file=/var/log/tallylog deny=5 even_deny_root unlock_time=1800 root_unlock_time=1800

password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=4

=======================

[root@dlp ~]# vi /etc/login.defs

1. line 28: set 7 for number of days for warnings

PASS_WARN_AGE 7