Hardening – Securing passwords with PAM in GNU/Linux

Previously we saw how to perform a basic configuration to secure our GNU/Linux servers (Basic hardening in GNU/Linux), en este caso vamos a fortalecer las contraseñas de acceso de los usuarios mediante Módulos de Autentificación Conectables.

What is PAM?

The pluggable authentication module (PAM) framework allows administrators to coordinate and configure user authentication requirements for accounts, credentials, sessions, and passwords without modifying the services that require authentication.

La estructura PAM permite a las organizaciones personalizar la experiencia de autenticación del usuario y la función de administración de contraseñas, sesiones y cuentas. Los servicios de entrada del sistema, como login and ssh, they use the PAM framework to protect all entry points of the newly installed system. PAM allows replacement or modification of authentication modules in the field to protect the system against any newly detected weaknesses without the need to make changes to any system services that use the PAM framework.

Installation on Debian and derivatives: :

apt-get install libpam-cracklib

We configure the directives in the common-password file

vi /etc/pam.d/common-password

Installation in Red-Hat and derivatives:

yum install cracklib

We configure the directives in the system-auth file

vi /etc/pam.d/system-auth

Configure policies:

Once inside the file we look for the line «password        requisite                       pam_cracklib.so retry=3 minlen=8 difok=3«. In this line we define the complexity of the password.

Example:

password requisite pam_cracklib.so try_first_pass retry=3 minlen=8 lcredit=1 ucredit=1 dcredit=1 ocredit=1

• minlen: specifies the minimum number of characters.
• lcredit: specifies the minimum number of lowercase letters
• ucredit: specifies the minimum number of uppercase letters
• credit: specifies the minimum number of numeric characters
• credit: specifies the number of characters of other types, such as symbols.

Define the password expiration period:

To set a maximum password period, you must edit the following variables in /etc/login.defs.

PASS_MAX_DAYS   99999

PASS_MIN_DAYS   0

PASS_WARN_AGE   7

In my case I have left it like this:

PASS_MAX_DAYS   100

PASS_MIN_DAYS   0

PASS_WARN_AGE   10

This policy will force users to change their password every 100 days, and will send a message 10 days before the password expires.

Using the chage command we can set the expiration of passwords for a specific user.

We see the directives of a user:

chage -l rokitoh

Último cambio de contraseña                    :ene 28, 2015

La contraseña caduca                    : nunca

Contraseña inactiva                    : nunca

La cuenta caduca                        : nunca

Número de días mínimo entre cambio de contraseña        : 0

Número de días máximo entre cambio de contraseña        : 99999

Número de días de aviso antes de que caduque la contraseña    : 7

By default, a user's password is set to never expire. To change this we simply execute the following command:

chage -E 5/02/2016 -m 10 -M 80 -I 30 -W 14 rokitoh

• -E 02/05/2016: Establishes that the password will expire on: 02/05/2016
• -m 10 -M 80: Maximum/minimum number of days between changes.
• -I 30: It will be locked 30 days after the password expires.
• -W 14: Send warning message 14 days before password expiration

Greetings, rokitoh!

:wq!