Bug 2230196

Words from the customer:

1. Proposed title of this feature request.
[RFE] Enforcing password complexity when using the pk12util.

2. What is the nature and description of the request?
Password complexity is configured correctly in /etc/security/pwquality.conf but when the 'pk12util' prompts for a passphrase, it accepts weak passwords ignoring settings in /etc/security/pwquality.conf. Need a  way to enforce password complexity when generating PKCS#12 bundles using the 'pk12util'

3. Why do you need this? 
The business model requires technical solutions to operate in very highly secure environments and these solutions must comply with a lot of standards that enforce highly complex passwords/passphrases. This RFE is to comply with such requirements as NIST, FIPS, DISA, etc.

4. How would you like to achieve this? 

a.) Define stronger password policy and password quality in the /etc/security/pwquality.conf file.
b.) In this case, what they're requesting is to make enhancements to the 'pk12util' and these enhancements would leverage password policies defined at the RHEL operating system level. The 'pk12util' is used to generate PKCS#12 certificate bundles which require a passphrase to be entered for the resulting PKCS#12 output file. They are requesting that the 'pk12util' applies the underlying password policies and password complexity rules defined in the RHEL operating system as suggested in 2a above. The 'pk12util' should reject any passphrases that do not comply with said password policies.

5 . For each functional requirement listed, specify how Red Hat and the customer can test to confirm the requirement is successfully implemented.

For 2a, make changes in the /etc/security/pwquality.conf and the relevant PAM files to require passwords entered must meet the minimum requirements defined in the files. Next, set up a test user in RHEL and try setting shorter passwords and verify if shorter passwords are rejected, for example. At a minimum, the password policy should be:

Password length is >= 18 characters.

Password must be built from at least 3 character classes.

Password must contain uppercase letters.

Password must contain lowercase letters.

Password must contain numbers (0-9).

Password cannot repeat characters from a single character class.

For 2b, modify the 'pk12util' source code to leverage password policies defined in the RHEL operating system. Next, set up a temporary NSS database on the test system and also set up a test CA using RHCS. Then create a CSR for a dummy user/device using the 'certutil' command in the NSS database. Submit the CSR to the test CA and generate the respective certificate. Finally, use the 'pk12util' command to generate a PKCS12 certificate bundle that includes the certificate and the private key. When 'pk12util' prompts for a passphrase at this step, it should only accept passphrases that comply with the password policies defined in functional requirement# 2a. Try different passphrases that test each of the password policies defined in 2a and verify that the 'pk12util' follows this policy when accepting passphrases.

6. Is there already an existing RFE upstream or in Red Hat Bugzilla?
The customer is not aware of any upstream bugs on this.

7 . Does you have any specific timeline dependencies and which release would they like to target (i.e. RHEL8, RHEL9)?
They need this in RHEL 8.6 at the moment.

8. List any affected packages or components.
Red Hat PKI tools and NSS database including the 'certutil' command.

9. Would you be able to assist in testing this functionality if implemented?
Time permitting and barring any scheduling conflicts.