Bug 673398 - request for additional pam_cracklib checks
request for additional pam_cracklib checks
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: pam (Show other bugs)
6.1
All All
urgent Severity high
: rc
: ---
Assigned To: Tomas Mraz
Dalibor Pospíšil
: FutureFeature, Reopened, ZStream
Depends On:
Blocks: 750571 756082 809247 809370
  Show dependency treegraph
 
Reported: 2011-01-27 21:53 EST by Jeffrey Blank
Modified: 2013-02-21 05:32 EST (History)
10 users (show)

See Also:
Fixed In Version: pam-1.1.1-11.el6
Doc Type: Release Note
Doc Text:
The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the /etc/passwd file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, which could be used by an attacker for an attempt to crack the password. The pam_cracklib module now allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password via the maxrepeatclass option.
Story Points: ---
Clone Of:
: 809247 (view as bug list)
Environment:
Last Closed: 2013-02-21 05:32:21 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jeffrey Blank 2011-01-27 21:53:35 EST
Description of problem:

The problem is that a new government directive requires:

1) no usage of the username or the real name in the password
2) no more than 3 characters from the same character class appear consecutively in the password

(character class refers to upper, lower, digit, and special/punctuation.)

I can provide a reference to the requirements document if this is helpful.


Additional info:
I am aware that reject_username already exists.  It can reject usage of the username.  
However, there is no ability to prevent usage of strings from the "real name" (which is typically stored in the pw_gecos element of the passwd struct).  It should be reasonable to cause the existing reject_username option to also reject usage of any space-separated strings from pw_gecos (which are greater than length 3, for sanity).

For the other requested check, a "maxrepeatclass=" option would be nice.

If it would be helpful for me to include a patch for pam_cracklib.c, please let me know.  Or, if it's more appropriate to submit this request to the upstream site, I can do that.

Thanks!
Comment 2 Tomas Mraz 2011-01-28 03:15:58 EST
If you have patch already please send it to the upstream mailing list for review. That would be really helpful.
Comment 3 RHEL Product and Program Management 2011-07-05 20:06:20 EDT
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unfortunately unable to
address this request at this time. Red Hat invites you to
ask your support representative to propose this request, if
appropriate and relevant, in the next release of Red Hat
Enterprise Linux. If you would like it considered as an
exception in the current release, please ask your support
representative.
Comment 18 Miroslav Svoboda 2012-04-13 06:46:22 EDT
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
The pam_cracklib is a PAM module for password-quality checking used by various applications. With this update, the pam_cracklib module has been improved with additional password-quality checks. The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the "/etc/passwd" file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, and these information could be used by an attacker for an attempt to crack the password. The pam_cracklib module now also allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password.
Comment 19 Miroslav Svoboda 2012-04-13 06:48:38 EDT
    Technical note updated. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    Diffed Contents:
@@ -1 +1 @@
-The pam_cracklib is a PAM module for password-quality checking used by various applications. With this update, the pam_cracklib module has been improved with additional password-quality checks. The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the "/etc/passwd" file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, and these information could be used by an attacker for an attempt to crack the password. The pam_cracklib module now also allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password.+The pam_cracklib is a PAM module for password-quality checking used by various applications. With this update, the pam_cracklib module has been improved with additional password-quality checks. The pam_cracklib module now allows to check whether a new password contains the words from the GECOS field from entries in the "/etc/passwd" file. The GECOS field is used to store additional information about the user, such as the user's full name or a phone number, which could be used by an attacker for an attempt to crack the password. The pam_cracklib module now also allows to specify the maximum allowed number of consecutive characters of the same class (lowercase, uppercase, number and special characters) in a password.
Comment 20 Jiri Pallich 2012-10-09 08:40:47 EDT
Since this is a parent bug of an issue that has already been released via Z-Stream (e.g. rhel-6.3.z), this bug is going to be CLOSED as CURRENTRELEASE.
Comment 21 Jiri Pallich 2012-10-09 10:16:13 EDT
This bug is to be re-opened for rhel-6.4.0 since pam component will be updated in RHEL 6.4. Updating flags to rhel-6.4.0+.
Comment 24 errata-xmlrpc 2013-02-21 05:32:21 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0521.html

Note You need to log in before you can comment on or make changes to this bug.