cp \/etc\/pam.d\/system-auth \/etc\/pam.d\/system-auth.original<\/code><\/pre>\nOpen the configuration file for editing.<\/p>\n
vim \/etc\/pam.d\/system-auth<\/code><\/pre>\nLocate the line containing the pam_pwquality.so<\/code> modules;<\/p>\npassword requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=<\/code><\/pre>\nComment the line and replace by the line below;<\/p>\n
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= minlen=8 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 enforce_for_root<\/strong><\/code><\/pre>\nWhere:<\/p>\n
\nminlen=8<\/code><\/strong>– sets the minimum password length to 8 characters.<\/li>\nlcredit=-1<\/code><\/strong> -Sets the minimum number of lower case letters that the password should contain to at least one<\/li>\nucredit=-1<\/code><\/strong>-Sets the minimum number of upper case letters on a password to at least one.
\n<\/strong><\/li>\ndcredit=-1<\/code><\/strong> – Sets the minimum number of digits to be contained in a password to at least one<\/li>\nocredit=-1<\/code><\/strong> – Set the minimum number of other symbols such as @, #, ! $ % etc on a password to at least one<\/li>\nenforce_for_root<\/code><\/strong> – Ensures that even if it is the root user that is setting the password, the complexity policies should be enforced.<\/li>\n<\/ul>\nYou can also achieve the same by using the authconfig<\/code> command line utility as shown below;<\/p>\nauthconfig --enablereqlower --enablerequpper --enablereqdigit --enablereqother --passminlen=8 --passmaxrepeat=3 --update<\/code><\/pre>\nThe above command basically ensures that password should have at least (in the respective order);<\/p>\n
\n- one lower case letter<\/li>\n
- one upper case letter<\/li>\n
- one digit<\/li>\n
- an alphanumeric character.<\/li>\n
- 8 characters in length<\/li>\n
- no more than 3 characters similar to the previous password.<\/li>\n<\/ul>\n
The changes will updated on \/etc\/security\/pwquality.conf<\/code>.<\/p>\ntail \/etc\/security\/pwquality.conf\r\n# Path to the cracklib dictionaries. Default is to use the cracklib default.\r\n# dictpath =\r\nminlen = 8\r\nminclass = 1\r\nmaxrepeat = 3\r\nmaxclassrepeat = 0\r\nlcredit = -1\r\nucredit = -1\r\ndcredit = -1\r\nocredit = -1<\/code><\/pre>\nNote that root or any user with sudo rights can always set any password irrespective of the enforced policies. However, to ensure that the password complexity policies applies to both root and user with sudo, you must append the enforce_for_root<\/code><\/strong> option to the line below on \/etc\/pam.d\/system-auth<\/code>.<\/p>\npassword requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= enforce_for_root<\/strong><\/code><\/pre>\nTesting Password Enforcement Policy<\/h3>\n
As a root user, try to change the password of a user with a password that doesn’t meet the set credentials.<\/p>\n
[root@Cent7 ~]# passwd amos\r\nChanging password for user amos.\r\nNew password: @moskifaru1\r\nBAD PASSWORD: The password contains less than 1 uppercase letters\r\nNew password: @mosKifaru\r\nBAD PASSWORD: The password contains less than 1 digits\r\nNew password: mosKifaru1\r\nBAD PASSWORD: The password contains less than 1 non-alphanumeric characters\r\npasswd: Have exhausted maximum number of retries for service<\/code><\/pre>\nTest using a more complex password; @mosKifaru1<\/p>\n
[root@Cent7 ~]# passwd amos\r\nChanging password for user amos.\r\nNew password: @mosKifaru1\r\nRetype new password: @mosKifaru1\r\npasswd: all authentication tokens updated successfully.<\/code><\/pre>\nThat is all about how to enforce password complexity policy on CentOS 7. Enjoy.<\/p>\n","protected":false},"excerpt":{"rendered":"
In this guide, we are going to learn how to enforce password complexity policy on CentOS 7\/RHEL based derivatives. Our previous guide covered the enforcement<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[352,34],"tags":[88,356],"class_list":["post-2403","post","type-post","status-publish","format-standard","hentry","category-password-policies","category-security","tag-centos-7","tag-pam_pwquality","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/2403"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=2403"}],"version-history":[{"count":6,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/2403\/revisions"}],"predecessor-version":[{"id":2411,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/2403\/revisions\/2411"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=2403"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=2403"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=2403"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}