Changeset c0c33269

Timestamp:

07/04/2007 05:46:38 PM (17 years ago)

Author:

DJ Lucas <dj@…>

Branches:

10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 12.1, 12.2, 6.3, 6.3-rc1, 6.3-rc2, 6.3-rc3, 7.10, 7.4, 7.5, 7.6, 7.6-blfs, 7.6-systemd, 7.7, 7.8, 7.9, 8.0, 8.1, 8.2, 8.3, 8.4, 9.0, 9.1, basic, bdubbs/svn, elogind, gimp3, gnome, kde5-13430, kde5-14269, kde5-14686, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, krejzi/svn, lazarus, lxqt, nosym, perl-modules, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, systemd-11177, systemd-13485, trunk, upgradedb, xry111/for-12.3, xry111/intltool, xry111/llvm18, xry111/soup3, xry111/spidermonkey128, xry111/test-20220226, xry111/xf86-video-removal

Children:

4d62032

Parents:

977f525

Message:

Set pam_cracklib to defaults and added security note.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@6834 af4574ff-66df-0310-9fd7-8a98e5e911e0

Files:

• introduction/welcome/changelog.xml (modified) (1 diff)
• postlfs/security/shadow.xml (modified) (2 diffs)

introduction/welcome/changelog.xml

@@ -48 +48 @@
           <para>[randy] - Updated to libxlst-1.1.21.</para>
         </listitem>
+        <listitem>
+          <para>[dj] - Modified Linux-PAM configuration to use cracklib
+          defaults.</para>
+        </listitem>
       </itemizedlist>
     </listitem>

postlfs/security/shadow.xml

@@ -359 +359 @@
 session     optional       pam_lastlog.so
 session     required       pam_unix.so
-password    required       pam_cracklib.so  retry=3 difok=8 minlen=5 \
-                                            dcredit=3 ocredit=3 \
-                                            ucredit=2 lcredit=2
+password    required       pam_cracklib.so  retry=3 
 password    required       pam_unix.so      md5 shadow use_authtok
 
@@ -399 +397 @@
 <literal># Begin /etc/pam.d/passwd
 
-password    required       pam_cracklib.so  retry=3 difok=8 minlen=5 \
-                                            dcredit=3  ocredit=3 \
-                                            ucredit=2  lcredit=2
+password    required       pam_cracklib.so  type=Linux retry=1 \
+                                            difok=5 diffignore=23 minlen=9 \
+                                            dcredit=1 ucredit=1 lcredit=1 \
+                                            ocredit=1 \
+                                            dictpath=/lib/cracklib/pw_dict 
 password    required       pam_unix.so      md5 shadow use_authtok
 
 # End /etc/pam.d/passwd</literal>
 EOF</userinput></screen>
+
+        <note><para>In its default configuration, owing to credits,
+        pam_cracklib will allow multiple case passwords as short as 6
+        characters, even with the <parameter>minlen</parameter> value
+        set to 11.  You should review the pam_cracklib(8) man page and
+        determine if these default values are acceptable for the security
+        of your system.</para></note>
 
       </sect4>