Bug 673398

Summary:	request for additional pam_cracklib checks
Product:	Red Hat Enterprise Linux 6	Reporter:	Jeffrey Blank <blank>
Component:	pam	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED ERRATA	QA Contact:	Dalibor Pospíšil <dapospis>
Severity:	high	Docs Contact:
Priority:	urgent
Version:	6.1	CC:	cevich, dapospis, degts, jduncan, jpallich, jwest, msvoboda, mvadkert, pvrabec, swells
Target Milestone:	rc	Keywords:	FutureFeature, Reopened, ZStream
Target Release:	---
Hardware:	All
OS:	All
Whiteboard:
Fixed In Version:	pam-1.1.1-11.el6	Doc Type:	Release Note
Doc Text:	The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the /etc/passwd file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, which could be used by an attacker for an attempt to crack the password. The pam_cracklib module now allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password via the maxrepeatclass option.	Story Points:	---
Clone Of:
Clones:	809247 (view as bug list)		Environment:
Last Closed:	2013-02-21 10:32:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	750571, 756082, 809247, 809370

Description Jeffrey Blank 2011-01-28 02:53:35 UTC

Description of problem:

The problem is that a new government directive requires:

1) no usage of the username or the real name in the password
2) no more than 3 characters from the same character class appear consecutively in the password

(character class refers to upper, lower, digit, and special/punctuation.)

I can provide a reference to the requirements document if this is helpful.


Additional info:
I am aware that reject_username already exists.  It can reject usage of the username.  
However, there is no ability to prevent usage of strings from the "real name" (which is typically stored in the pw_gecos element of the passwd struct).  It should be reasonable to cause the existing reject_username option to also reject usage of any space-separated strings from pw_gecos (which are greater than length 3, for sanity).

For the other requested check, a "maxrepeatclass=" option would be nice.

If it would be helpful for me to include a patch for pam_cracklib.c, please let me know.  Or, if it's more appropriate to submit this request to the upstream site, I can do that.

Thanks!

Comment 2 Tomas Mraz 2011-01-28 08:15:58 UTC

If you have patch already please send it to the upstream mailing list for review. That would be really helpful.

Comment 3 RHEL Program Management 2011-07-06 00:06:20 UTC

This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unfortunately unable to
address this request at this time. Red Hat invites you to
ask your support representative to propose this request, if
appropriate and relevant, in the next release of Red Hat
Enterprise Linux. If you would like it considered as an
exception in the current release, please ask your support
representative.

Comment 18 Miroslav Svoboda 2012-04-13 10:46:22 UTC

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
The pam_cracklib is a PAM module for password-quality checking used by various applications. With this update, the pam_cracklib module has been improved with additional password-quality checks. The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the "/etc/passwd" file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, and these information could be used by an attacker for an attempt to crack the password. The pam_cracklib module now also allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password.

Comment 19 Miroslav Svoboda 2012-04-13 10:48:38 UTC

    Technical note updated. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    Diffed Contents:
@@ -1 +1 @@
-The pam_cracklib is a PAM module for password-quality checking used by various applications. With this update, the pam_cracklib module has been improved with additional password-quality checks. The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the "/etc/passwd" file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, and these information could be used by an attacker for an attempt to crack the password. The pam_cracklib module now also allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password.+The pam_cracklib is a PAM module for password-quality checking used by various applications. With this update, the pam_cracklib module has been improved with additional password-quality checks. The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the "/etc/passwd" file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, which could be used by an attacker for an attempt to crack the password. The pam_cracklib module now also allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password.

Comment 20 Jiri Pallich 2012-10-09 12:40:47 UTC

Since this is a parent bug of an issue that has already been released via Z-Stream (e.g. rhel-6.3.z), this bug is going to be CLOSED as CURRENTRELEASE.

Comment 21 Jiri Pallich 2012-10-09 14:16:13 UTC

This bug is to be re-opened for rhel-6.4.0 since pam component will be updated in RHEL 6.4. Updating flags to rhel-6.4.0+.

Comment 24 errata-xmlrpc 2013-02-21 10:32:21 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0521.html