Bug 1547950

Summary: [RFE][usability] Allow for easy configuration in line with NIST SP 800-63-3
Product: [Fedora] Fedora Reporter: Alicja Kario <hkario>
Component: distributionAssignee: Aoife Moloney <amoloney>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: rawhideCC: dennis, kevin
Target Milestone: ---Keywords: FutureFeature
Target Release: ---Flags: blc: mirror-
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 983187    
Bug Blocks:    

Description Alicja Kario 2018-02-22 11:10:25 UTC 
Currently libpwquality.conf file specifies over 10 different options.
Rate limiting is even harder to set up.
Configuring it in a way that meets NIST SP 800-63-3 requirements is hard or at least non trivial.

It should be possible to set a single variable, specifying the required security level that would guarantee safe operation, in a manner similar to FIPS mode.

this will require ability to measure password's guessing entropy and support from different pam modules to enforce rate limiting
Comment 1 Alicja Kario 2018-02-22 14:33:15 UTC 
See also: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/
Comment 2 Kevin Fenzi 2018-02-22 21:38:48 UTC 
Can you tell us why this bug exists? I would think this would be something you would need to convince the maintainer to do...
Comment 3 Tomas Mraz 2018-02-23 07:45:32 UTC 
+1, Kevin, I as PAM maintainer am not convinced. Also this would probably need to be at least partially implemented in authselect, which is the new replacement for authconfig, that will be configuring the PAM stacks in future Fedora releases.