Red Hat Bugzilla – Bug 673398
request for additional pam_cracklib checks
Last modified: 2013-02-21 05:32:21 EST
Description of problem: The problem is that a new government directive requires: 1) no usage of the username or the real name in the password 2) no more than 3 characters from the same character class appear consecutively in the password (character class refers to upper, lower, digit, and special/punctuation.) I can provide a reference to the requirements document if this is helpful. Additional info: I am aware that reject_username already exists. It can reject usage of the username. However, there is no ability to prevent usage of strings from the "real name" (which is typically stored in the pw_gecos element of the passwd struct). It should be reasonable to cause the existing reject_username option to also reject usage of any space-separated strings from pw_gecos (which are greater than length 3, for sanity). For the other requested check, a "maxrepeatclass=" option would be nice. If it would be helpful for me to include a patch for pam_cracklib.c, please let me know. Or, if it's more appropriate to submit this request to the upstream site, I can do that. Thanks!
If you have patch already please send it to the upstream mailing list for review. That would be really helpful.
This request was evaluated by Red Hat Product Management for inclusion in the current release of Red Hat Enterprise Linux. Because the affected component is not scheduled to be updated in the current release, Red Hat is unfortunately unable to address this request at this time. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux. If you would like it considered as an exception in the current release, please ask your support representative.
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: The pam_cracklib is a PAM module for password-quality checking used by various applications. With this update, the pam_cracklib module has been improved with additional password-quality checks. The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the "/etc/passwd" file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, and these information could be used by an attacker for an attempt to crack the password. The pam_cracklib module now also allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password.
Technical note updated. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. Diffed Contents: @@ -1 +1 @@ -The pam_cracklib is a PAM module for password-quality checking used by various applications. With this update, the pam_cracklib module has been improved with additional password-quality checks. The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the "/etc/passwd" file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, and these information could be used by an attacker for an attempt to crack the password. The pam_cracklib module now also allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password.+The pam_cracklib is a PAM module for password-quality checking used by various applications. With this update, the pam_cracklib module has been improved with additional password-quality checks. The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the "/etc/passwd" file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, which could be used by an attacker for an attempt to crack the password. The pam_cracklib module now also allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password.
Since this is a parent bug of an issue that has already been released via Z-Stream (e.g. rhel-6.3.z), this bug is going to be CLOSED as CURRENTRELEASE.
This bug is to be re-opened for rhel-6.4.0 since pam component will be updated in RHEL 6.4. Updating flags to rhel-6.4.0+.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0521.html