Set Password Rules

Set Password Rules 2015/07/23

	Set Password Rules for security reasons.
[1]	Set number of days for password Expiration. Users must change their password within the days. This setting impacts only when creating a user, not impacts to exisiting users. If set to exisiting users, run the command "chage -M (days) (user)".

[root@dlp ~]#  vi /etc/login.defs # line 25: set 60 for Password Expiration PASS_MAX_DAYS  60

[2]	Set minimum number of days available of password. Users must use their password at least this days after changing it. This setting impacts only when creating a user, not impacts to exisiting users. If set to exisiting users, run the command "chage -m (days) (user)".

[root@dlp ~]#  vi /etc/login.defs # line 26: set 2 for Minimum number of days available PASS_MIN_DAYS  2

[3]	Set number of days for warnings before expiration. This setting impacts only when creating a user, not impacts to exisiting users. If set to exisiting users, run the command "chage -W (days) (user)".

[root@dlp ~]#  vi /etc/login.defs # line 28: set 7 for number of days for warnings PASS_WARN_AGE  7

[4]	Limit using a password that was used in past. Users can not set the same password within the generation.

[root@dlp ~]#  vi /etc/pam.d/system-auth # near line 15: prohibit to use the same password for 5 generation in past password     sufficient     pam_unix.so sha512 shadow nullok try_first_pass use_authtok  remember=5

[5]	Set minimum password length. Users can not set thier password length less than this parameter.

# set 8 for minimum password length [root@dlp ~]#  authconfig --passminlen=8 --update # the parameter is set in a config below [root@dlp ~]#  grep "^minlen" /etc/security/pwquality.conf  minlen = 8

[6]	Set minimum number of required classes of characters for the new password. (kinds ⇒ UpperCase / LowerCase / Digits / Others)

# set 2 for minimum number of required classes of characters [root@dlp ~]#  authconfig --passminclass=2 --update # the parameter is set in a config below [root@dlp ~]#  grep "^minclass" /etc/security/pwquality.conf  minclass = 2

[7]	Set maximum number of allowed consecutive same characters in the new password.

# set 2 for maximum number of allowed consecutive same characters [root@dlp ~]#  authconfig --passmaxrepeat=2 --update # the parameter is set in a config below [root@dlp ~]#  grep "^maxrepeat" /etc/security/pwquality.conf  maxrepeat = 2

[8]	Set maximum number of allowed consecutive characters of the same class in the new password.

# set 4 for maximum number of allowed consecutive characters of the same class [root@dlp ~]#  authconfig --passmaxclassrepeat=4 --update # the parameter is set in a config below [root@dlp ~]#  grep "^maxclassrepeat" /etc/security/pwquality.conf  maxclassrepeat = 4

[9]	Require at least one lowercase character in the new password.

[root@dlp ~]#  authconfig --enablereqlower --update # the parameter is set in a config below # (if you'd like to edit the value, edit it with vi and others) [root@dlp ~]#  grep "^lcredit" /etc/security/pwquality.conf  lcredit = -1

[10]	Require at least one uppercase character in the new password.

[root@dlp ~]#  authconfig --enablerequpper --update # the parameter is set in a config below # (if you'd like to edit the value, edit it with vi and others) [root@dlp ~]#  grep "^ucredit" /etc/security/pwquality.conf  ucredit = -1

[11]	Require at least one digit in the new password.

[root@dlp ~]#  authconfig --enablereqdigit --update # the parameter is set in a config below # (if you'd like to edit the value, edit it with vi and others) [root@dlp ~]#  grep "^dcredit" /etc/security/pwquality.conf  dcredit = -1

[12]	Require at least one other character in the new password.

[root@dlp ~]#  authconfig --enablereqother --update # the parameter is set in a config below # (if you'd like to edit the value, edit it with vi and others) [root@dlp ~]#  grep "^ocredit" /etc/security/pwquality.conf  ocredit = -1

[13]	Set maximum length of monotonic character sequences in the new password. (ex ⇒ '12345', 'fedcb')

[root@dlp ~]#  vi /etc/security/pwquality.conf # add to the end maxsequence = 3

[14]	Set number of characters in the new password that must not be present in the old password.

[root@dlp ~]#  vi /etc/security/pwquality.conf # add to the end difok = 5

[15]	Check whether the words longer than 3 characters from the GECOS field of the user's passwd entry are contained in the new password.

[root@dlp ~]#  vi /etc/security/pwquality.conf # add to the end gecoscheck = 1

[16]	Set Ssace separated list of words that must not be contained in the password.

[root@dlp ~]#  vi /etc/security/pwquality.conf # add to the end badwords = denywords1 denywords2 denywords3

[17]	Set hash/crypt algorithm for new passwords. (default is sha512)

# show current algorithm [root@dlp ~]#  authconfig --test | grep hashing  password hashing algorithm is md5 # chnage algorithm to sha512 [root@dlp ~]#  authconfig --passalgo=sha512 --update [root@dlp ~]#  authconfig --test | grep hashing  password hashing algorithm is sha512