Home Command line utilities How To Force Users To Use Strong Passwords In Debian And Ubuntu
Force Users To Use Strong Passwords In Debian, Ubuntu

How To Force Users To Use Strong Passwords In Debian And Ubuntu

By sk
6987 Views

A strong password must have at least 14 characters, including at least one special character, one numerical character, one uppercase and one lower case letter. More importantly, passwords shouldn't be easily predictable and shouldn't be based on dictionary words. Some non-techie users, however, will not understand or don't care about the security. They will keep using the easily predictable passwords like pass123, welcome123, [email protected] etc., which can be easily broken in few attempts. Also, they won't change the passwords for ages. As a System administrator, it is your job to enforce a strong password policy in order to protect the systems from dictionary-based and brute-force attacks. This brief tutorial will walk you through how to force users to use strong passwords in DEB based distributions like Debian, Ubuntu, Linux Mint etc., using Pluggable Authentication Modules (PAM).

I have tested this guide in Ubuntu 16.04 LTS server edition. Although, the instructions posted here are same for Debian, and other Debian and Ubuntu based distributions such as Linux Mint, Elementary OS etc.

Force Users To Use Strong Passwords In Debian, Ubuntu, Linux Mint

The Pluggable Authentication Modules (PAM) is installed by default in DEB based systems. However, you need to install an additional module called libpam-cracklib. To do so, run the following command from Terminal:

$ sudo apt-get install libpam-cracklib

In DEB-based systems, the password policies are defined in /etc/pam.d/common-password file. Before making any changes, backup this file.

$ sudo cp /etc/pam.d/common-password /etc/pam.d/common-password.bak

Now, edit /etc/pam.d/common-password file:

$ sudo nano /etc/pam.d/common-password

Find the following line and edit or change it as shown below.

password required pam_cracklib.so try_first_pass retry=3 minlen=12 lcredit=1 ucredit=1 dcredit=2 ocredit=1 difok=2 reject_username
Edit /etc/pam.d/common-password file

Edit /etc/pam.d/common-password file

Let us break down this line and see what each option will do.

  • retry=N - Maximum number of retries to change password. N indicates the number. The default for this parameter is 1.
  • minlen=N - The minimum acceptable size for the new password (plus one if credits are not disabled which is the default). In addition to the number of characters in the new password, credit (of +1 in length) is given for each different kind of character (other, upper, lower and digit). The default value is 9.
  • lcredit=N - Define the maximum credit for containing lowercase letters in the password. Default value is 1.
  • ucredit=N - Define the maximum number for containing uppercase letters in the password. Default value is 1.
  • dcredit=N - Define the maximum credit for containing digits in the password. Default value is 1.
  • ocredit=N - Define the maximum credit for containing other characters in the password. Default value is 1.
  • difok=N - Define number of characters that must be different from the previous password.
  • reject_username - Restrict the users to use their name as password.

Hope you got a basic idea about the aforementioned parameters.

As defined in the above file, the users should now use the password with a password complexity score of 12. One 'credit' will be given to 1 lowercase letter, 1 credit for 1 uppercase letter, 1 credit for at least 2 digits, and 1 credit for 1 other character.

However, you can disable the credits by assigning negative values, and force the user to use combination of different characters with a minimum length.

Check the following example:

password required pam_cracklib.so minlen=8 lcredit=-1 ucredit=-1 dcredit=-2 ocredit=-1 difok=2 reject_username

As defined above, the users must use a password complexity score of 8 characters, including 1 lowercase letter, 1 uppercase letter, 2 digits, and 1 other character.

Please note that these restrictions are applied for the normal users only, but not for root user. Root user is free to use any type of password.

Check or verify the password complexity

Once you defined the password policy, check whether it's working or not.

Let us a assign simple password that doesn't meet the password policy and see what happens.

To change or assign a password to the currently logged-in user, run:

$ passwd

Sample output:

Changing password for sk.
(current) UNIX password: 
New password: 
BAD PASSWORD: it is WAY too short
New password: 
BAD PASSWORD: it does not contain enough DIFFERENT characters
New password: 
BAD PASSWORD: it is based on a dictionary word
passwd: Have exhausted maximum number of retries for service
passwd: password unchanged
Set user's password using passwd command

Set user's password using passwd command

As you see in the above output, the user can't set the password because the given password doesn't meet the requirements.

Let us try a password that meets the actual password policy (including at least 1 lowercase, 1 upper case, 2 digits, 1 other character).

passwd command

passwd command

As you see in the above screenshot, a secure password has been set to the user "sk".

That's all for now. We have successfully enforced the password policies using PAM. For more details, check man pages.

$ man pam_cracklib

Don't forget to check our detailed guide about implementing password policies in Linux.

Want to know how to generate a strong password? Check the following article.

Thanks for stopping by!

Help us to help you:

Have a Good day!!

You May Also Like

2 comments

Michael T November 18, 2019 - 10:02 am

Why are you talking about ‘maximum complexity’ when talking bout minlen. Don’t you mean ‘*minimum complexity?’

Reply
sk November 18, 2019 - 12:04 pm

Nice catch. Thanks for pointing out. Corrected it now.

Reply

Leave a Comment

* By using this form you agree with the storage and handling of your data by this website.

This site uses Akismet to reduce spam. Learn how your comment data is processed.

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Accept Read More