[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20080116222449.GA11905@openwall.com>
Date: Thu, 17 Jan 2008 01:24:49 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Core dump when using pam_passwdqc.so
On Wed, Jan 16, 2008 at 03:06:18PM +0100, Francine Herrmann wrote:
> I want to enforce my password command on my system Linux Mandriva 2006
> with pam_passwdqc.
This is not exactly a question about JtR, but it is closely related - so
I am going to let it be discussed on this mailing list as long as the
discussion does not run for too long.
> I compiled and fixed some errors.
There should have been no errors. Please start anew. If you still run
into issues ("errors" to fix), please post the exact compiler(?) errors
and warnings in here. Otherwise, it is impossible to figure out just
what you "fixed" (possibly breaking stuff).
My guess is that there's an issue with your system resulting in those
errors. If so, we'll need to fix the underlying issue instead.
> Finally I got pam_passwdqc.so that I copy in /lib/security
That's fine. "make install" would also do it.
BTW, it is possible to build an RPM package out of the pam_passwdqc
tarball with:
rpmbuild -tb pam_passwdqc-1.0.4.tar.gz
after having setup an "RPM build environment" under your non-root user
account, such as with the rpminit script:
http://cvsweb.openwall.com/cgi/cvsweb.cgi/~checkout~/Owl/packages/rpm/rpminit?rev=HEAD;content-type=text%2Fplain
There's a man page for the rpminit script; it may be found in the same
CVS directory:
http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/rpm/
> I modified the lines password in the file /etc/pam.d /passwd:
>
> password required pam_passwdqc.so min=disabled,12,8,6,5 max=40
> passphrase=3 match=4 similar=deny random=42 enforce=everyone retry=3
>
> password sufficient pam_unix.so nullok use_authtok md5 shadow
> use_first_pass
There are a few issues with this:
- min=disabled,12,8,6,5 will permit too weak passwords to be set;
- in the second line, use "required", not "sufficient";
- there are probably services other than the "passwd" command that are
capable of changing passwords - e.g., when logging in to an account with
expired password - so you could want to similarly update "password"
lines in other /etc/pam.d files, or maybe in /etc/pam.d/system-auth (if
Mandriva uses that file; I don't know).
I hope this helps, and please post those compiler errors and warnings
and/or describe how you "fixed" them in detail.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: 5B341F15 fp: B3FB 63F4 D7A3 BCCC 6F6E FC55 A2FC 027C 5B34 1F15
http://www.openwall.com - bringing security into open computing environments
Was I helpful? Please give your feedback here: http://rate.affero.net/solar
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
