Bug 1065960

Summary:	pam does not enforce password complexity restrictions on root
Product:	Red Hat Enterprise Linux 7	Reporter:	Dalibor Pospíšil <dapospis>
Component:	pam	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED NOTABUG	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	high	Docs Contact:
Priority:	high
Version:	7.0	CC:	dapospis, ed.sealing, jduncan, mvadkert, nilesh.bhosale, rmcswain, tmraz, trey.henefield
Target Milestone:	rc	Keywords:	Regression
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	588893	Environment:
Last Closed:	2014-02-17 13:25:13 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Dalibor Pospíšil 2014-02-17 12:07:48 UTC

+++ This bug was initially created as a clone of Bug #588893 +++

Description of problem:
Pam does not currently enforce password restrictions on root.

Version-Release number of selected component (if applicable):
pam-1.1.8-6.el7

How reproducible:
100%

Steps to Reproduce:
1. TESTUSER=ROOT /CoreOS/pam/Sanity/pam_cracklib

Comment 3 Tomas Mraz 2014-02-17 12:55:41 UTC

What does the /CoreOS/pam/Sanity/pam_cracklib test tests? Does it set up pam_cracklib with the enforce_for_root option?

Comment 4 Dalibor Pospíšil 2014-02-17 13:15:36 UTC

(In reply to Tomas Mraz from comment #3)
> What does the /CoreOS/pam/Sanity/pam_cracklib test tests? Does it set up
> pam_cracklib with the enforce_for_root option?

Yes, you can see it in https://beaker.engineering.redhat.com/tasks/executed?recipe_task_id=19195364 TESTOUT.log there is whole config printed.

Should the config be different from RHEL6?

Comment 5 Tomas Mraz 2014-02-17 13:25:13 UTC

Look at the configuration files - they are completely meaningless. They put the pam_cracklib at the end of the password stack which means that it is not called at all. You have to replace the pam_pwquality call with the pam_cracklib call instead.

Comment 6 Dalibor Pospíšil 2014-02-17 13:33:59 UTC

Taking back. I found out that the test assumed presence of cracklib on config file and so it placed those relevant option at the end of the config file which caused the issue.