Bug 1547950 - [RFE][usability] Allow for easy configuration in line with NIST SP 800-63-3
Summary: [RFE][usability] Allow for easy configuration in line with NIST SP 800-63-3
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: distribution
Version: rawhide
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: ---
Assignee: Aoife Moloney
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On: 983187
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-02-22 11:10 UTC by Alicja Kario
Modified: 2025-09-19 04:18 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: Bug
Embargoed:
blc: mirror-


Attachments (Terms of Use)

Description Alicja Kario 2018-02-22 11:10:25 UTC
Currently libpwquality.conf file specifies over 10 different options.
Rate limiting is even harder to set up.
Configuring it in a way that meets NIST SP 800-63-3 requirements is hard or at least non trivial.

It should be possible to set a single variable, specifying the required security level that would guarantee safe operation, in a manner similar to FIPS mode.

this will require ability to measure password's guessing entropy and support from different pam modules to enforce rate limiting

Comment 2 Kevin Fenzi 2018-02-22 21:38:48 UTC
Can you tell us why this bug exists? I would think this would be something you would need to convince the maintainer to do...

Comment 3 Tomas Mraz 2018-02-23 07:45:32 UTC
+1, Kevin, I as PAM maintainer am not convinced. Also this would probably need to be at least partially implemented in authselect, which is the new replacement for authconfig, that will be configuring the PAM stacks in future Fedora releases.


Note You need to log in before you can comment on or make changes to this bug.