RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 673398 - request for additional pam_cracklib checks
Summary: request for additional pam_cracklib checks
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: pam
Version: 6.1
Hardware: All
OS: All
urgent
high
Target Milestone: rc
: ---
Assignee: Tomas Mraz
QA Contact: Dalibor Pospíšil
URL:
Whiteboard:
Depends On:
Blocks: 750571 756082 809247 809370
TreeView+ depends on / blocked
 
Reported: 2011-01-28 02:53 UTC by Jeffrey Blank
Modified: 2018-11-27 21:25 UTC (History)
10 users (show)

Fixed In Version: pam-1.1.1-11.el6
Doc Type: Release Note
Doc Text:
The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the /etc/passwd file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, which could be used by an attacker for an attempt to crack the password. The pam_cracklib module now allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password via the maxrepeatclass option.
Clone Of:
: 809247 (view as bug list)
Environment:
Last Closed: 2013-02-21 10:32:21 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0521 0 normal SHIPPED_LIVE Moderate: pam security, bug fix, and enhancement update 2013-02-20 21:28:50 UTC

Description Jeffrey Blank 2011-01-28 02:53:35 UTC 
Description of problem:

The problem is that a new government directive requires:

1) no usage of the username or the real name in the password
2) no more than 3 characters from the same character class appear consecutively in the password

(character class refers to upper, lower, digit, and special/punctuation.)

I can provide a reference to the requirements document if this is helpful.


Additional info:
I am aware that reject_username already exists.  It can reject usage of the username.  
However, there is no ability to prevent usage of strings from the "real name" (which is typically stored in the pw_gecos element of the passwd struct).  It should be reasonable to cause the existing reject_username option to also reject usage of any space-separated strings from pw_gecos (which are greater than length 3, for sanity).

For the other requested check, a "maxrepeatclass=" option would be nice.

If it would be helpful for me to include a patch for pam_cracklib.c, please let me know.  Or, if it's more appropriate to submit this request to the upstream site, I can do that.

Thanks!
Comment 2 Tomas Mraz 2011-01-28 08:15:58 UTC 
If you have patch already please send it to the upstream mailing list for review. That would be really helpful.
Comment 3 RHEL Program Management 2011-07-06 00:06:20 UTC 
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unfortunately unable to
address this request at this time. Red Hat invites you to
ask your support representative to propose this request, if
appropriate and relevant, in the next release of Red Hat
Enterprise Linux. If you would like it considered as an
exception in the current release, please ask your support
representative.
Comment 18 Miroslav Svoboda 2012-04-13 10:46:22 UTC 
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
The pam_cracklib is a PAM module for password-quality checking used by various applications. With this update, the pam_cracklib module has been improved with additional password-quality checks. The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the "/etc/passwd" file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, and these information could be used by an attacker for an attempt to crack the password. The pam_cracklib module now also allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password.
Comment 19 Miroslav Svoboda 2012-04-13 10:48:38 UTC 
    Technical note updated. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    Diffed Contents:
@@ -1 +1 @@
-The pam_cracklib is a PAM module for password-quality checking used by various applications. With this update, the pam_cracklib module has been improved with additional password-quality checks. The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the "/etc/passwd" file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, and these information could be used by an attacker for an attempt to crack the password. The pam_cracklib module now also allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password.+The pam_cracklib is a PAM module for password-quality checking used by various applications. With this update, the pam_cracklib module has been improved with additional password-quality checks. The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the "/etc/passwd" file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, which could be used by an attacker for an attempt to crack the password. The pam_cracklib module now also allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password.
Comment 20 Jiri Pallich 2012-10-09 12:40:47 UTC 
Since this is a parent bug of an issue that has already been released via Z-Stream (e.g. rhel-6.3.z), this bug is going to be CLOSED as CURRENTRELEASE.
Comment 21 Jiri Pallich 2012-10-09 14:16:13 UTC 
This bug is to be re-opened for rhel-6.4.0 since pam component will be updated in RHEL 6.4. Updating flags to rhel-6.4.0+.
Comment 24 errata-xmlrpc 2013-02-21 10:32:21 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0521.html
Note You need to log in before you can comment on or make changes to this bug.