How To Force Users To Use Strong Passwords In Debian, Ubuntu
A strong password must be comprised of at least 14 characters, including at least one special character, one numerical character, one uppercase and lower case letter. More importantly, passwords shouldn’t be easily predictable and shouldn’t be based on dictionary words. Some non-techie people however will not understand or don’t care about the security. They will keep using easily predictable passwords like pass123, welcome123, [email protected] etc., that can be easily broken in few attempts. Also, they won’t change the passwords for ages. As a System administrator, it is your job to enforce a strong password policy in order to protect the systems from dictionary-based and brute-force attacks. This brief tutorial will walk you through how to force users to use strong passwords in DEB based distributions like Debian, Ubuntu, Linux Mint etc., using Pluggable Authentication Modules (PAM).
I have tested this guide in Ubuntu 16.04 LTS server edition. Although, the instructions posted here are same for Debian, and other Debian and Ubuntu based distributions such as Linux Mint, Elementary OS etc.
Force Users To Use Strong Passwords In Debian, Ubuntu, Linux Mint
PAM is installed by default in DEB based systems. However, you need to install an additional module called libpam-cracklib. To do so, run the following command from Terminal:
$ sudo apt-get install libpam-cracklib
In DEB based systems, the password policies are defined in /etc/pam.d/common-password file. Before making any changes, backup this file.
$ sudo cp /etc/pam.d/common-password /home/sk/
Now, edit /etc/pam.d/common-password file:
$ sudo nano /etc/pam.d/common-password
Find the following line and edit or change it as shown below.
password required pam_cracklib.so try_first_pass retry=3 minlen=12 lcredit=1 ucredit=1 dcredit=2 ocredit=1 difok=2 reject_username
Let us break down this line and see what does each option do.
- retry=N – Maximum number of retries to change password. N indicates the number. The default for this parameter is 1.
- minlen=N – The minimum acceptable size for the new password (plus one if credits are not disabled which is the default). In addition to the number of characters in the new password, credit (of +1 in length) is given for each different kind of character (other, upper, lower and digit). The default value is 9.
- lcredit=N – Define the maximum credit for containing lowercase letters in the password. Default value is 1.
- ucredit=N – Define the maximum number for containing uppercase letters in the password. Default value is 1.
- dcredit=N – Define the maximum credit for containing digits in the password. Default value is 1.
- ocredit=N – Define the maximum credit for containing other characters in the password. Default value is 1.
- difok=N – Define number of characters that must be different from the previous password.
- reject_username – Restrict the users to use their name as password.
Hope you got a basic idea about the above parameters.
As defined in the above file, the users can now use password with a password complexity score of 12. 1 ‘credit’ will be given to 1 lowercase letter, 1 credit for 1 uppercase letter, 1 credit for at least 2 digits, and 1 credit for 1 other character.
However, you can disable the credits by assigning negative values, and force the user to use combination of different characters with a minimum length.
Check the following example.
password required pam_cracklib.so minlen=8 lcredit=-1 ucredit=-1 dcredit=-2 ocredit=-1 difok=2 reject_username
As defined above, the users must use a password complexity score of 8 characters, including 1 lowercase letter, 1 uppercase letter, 2 digits, and 1 other character.
Please note that these restrictions are applied for the normal users only, but not for root user. Root user is free to use any type of password.
Check or verify the password complexity
Once you defined the password policy, check whether it’s working or not.
Let us a assign simple password that doesn’t meet the password policy and see what happens.
To change or assign passwd, run:
Changing password for sk. (current) UNIX password: New password: BAD PASSWORD: it is WAY too short New password: BAD PASSWORD: it does not contain enough DIFFERENT characters New password: BAD PASSWORD: it is based on a dictionary word passwd: Have exhausted maximum number of retries for service passwd: password unchanged
As you see in the above output, If the password doesn’t meet the requirements, the user can’t set the password.
Let us try a password that meets the actual password policy (including at least 1 lowercase, 1 upper case, 2 digits, 1 other character).
As you see in the above screenshot, a secure password has been set for the user “sk”.
That’s all for now. We have successfully enforced the password policies using PAM. For more details, check man pages.
$ man pam_cracklib
Don’t forget to check our detailed guide about implementing password policies in Linux.
Want to know how to generate a strong password? Check the following article.