Solaris Password Policy - Revision history

Hutch: /* Solaris SUNWssh Package Notes */

Hutch — Tue, 11 Dec 2007 17:28:47 GMT

Solaris SUNWssh Package Notes

←Older revision		Revision as of 17:28, 11 December 2007
Line 196:		Line 196:

	Therefore, an appropriate ''count_limit'' for this server is 7:		Therefore, an appropriate ''count_limit'' for this server is 7:
-	* 1 -- ''ssh user@host''	+	1 -- ''ssh user@host''
-	* 2 -- Failed login attempt 1	+	2 -- Failed login attempt 1
-	* 3 -- Failed login attempt 2	+	3 -- Failed login attempt 2
-	* 4 -- Failed login attempt 3; disconnected	+	4 -- Failed login attempt 3; disconnected
-	* 5 -- ''ssh user@host''	+	5 -- ''ssh user@host''
-	* 6 -- Failed login attempt 4	+	6 -- Failed login attempt 4
-	* 7 -- Failed login attempt 5	+	7 -- Failed login attempt 5

	== Storing Passwords in MD5 Format ==		== Storing Passwords in MD5 Format ==

Hutch: /* Solaris SUNWssh Package Notes */

Hutch — Tue, 11 Dec 2007 17:28:18 GMT

Solaris SUNWssh Package Notes

←Older revision		Revision as of 17:28, 11 December 2007
Line 182:		Line 182:
	* The appropriate directive to enable PAM with SUNWssh is '''PAMAuthenticationViaKBDInt yes'''.		* The appropriate directive to enable PAM with SUNWssh is '''PAMAuthenticationViaKBDInt yes'''.

-	* At least with ''pam_login_limit'' with Solaris 9 SUNWssh, a ~~login limit~~ failure is generated even before a password is entered.	+	* At least with ''pam_login_limit'' with Solaris 9 SUNWssh, a ''pam_login_limit'' failure is generated even before a password is entered.

	Example:		Example:

Hutch: /* Solaris SUNWssh Package Notes */

Hutch — Tue, 11 Dec 2007 17:20:00 GMT

Solaris SUNWssh Package Notes

←Older revision		Revision as of 17:20, 11 December 2007
Line 194:		Line 194:
	''syslog'' message:		''syslog'' message:
	Dec 11 12:01:41 host sshd[20260]: [ID 122574 auth.notice] pam_login_limit(auth): Unsuccessful attempt 1 for user 'hutchib'		Dec 11 12:01:41 host sshd[20260]: [ID 122574 auth.notice] pam_login_limit(auth): Unsuccessful attempt 1 for user 'hutchib'
		+
		+	Therefore, an appropriate ''count_limit'' for this server is 7:
		+	* 1 -- ''ssh user@host''
		+	* 2 -- Failed login attempt 1
		+	* 3 -- Failed login attempt 2
		+	* 4 -- Failed login attempt 3; disconnected
		+	* 5 -- ''ssh user@host''
		+	* 6 -- Failed login attempt 4
		+	* 7 -- Failed login attempt 5

	== Storing Passwords in MD5 Format ==		== Storing Passwords in MD5 Format ==

Hutch: /* Account Lockout */

Hutch — Tue, 11 Dec 2007 17:16:21 GMT

Account Lockout

←Older revision		Revision as of 17:16, 11 December 2007
Line 153:		Line 153:
	'''other password optional pam_login_limit.so.1'''		'''other password optional pam_login_limit.so.1'''

-	* If you are using ~~ssh~~:	+	=== OpenSSH Changes ===
-	** Make sure PAM support is enabled by setting '''UsePAM yes''' in ''sshd_config''.	+
-	** You may want to disable password authentication by setting '''PasswordAuthentcation no''' in ''sshd_config''. Without this, you will be prompted two additional times for your password if your account is locked (although you still won't be able to authenticate).	+	If you are using OpenSSH:
		+	* Make sure PAM support is enabled by setting '''UsePAM yes''' in ''sshd_config''.
		+	* You may want to disable password authentication by setting '''PasswordAuthentcation no''' in ''sshd_config''. Without this, you will be prompted two additional times for your password if your account is locked (although you still won't be able to authenticate).

	With '''PasswordAuthentication yes''':		With '''PasswordAuthentication yes''':
Line 175:		Line 177:
	Password:		Password:
	Permission denied (publickey,keyboard-interactive,hostbased).		Permission denied (publickey,keyboard-interactive,hostbased).
		+
		+	=== Solaris SUNWssh Package Notes ===
		+
		+	* The appropriate directive to enable PAM with SUNWssh is '''PAMAuthenticationViaKBDInt yes'''.
		+
		+	* At least with ''pam_login_limit'' with Solaris 9 SUNWssh, a login limit failure is generated even before a password is entered.
		+
		+	Example:
		+	$ ssh hutchib@host
		+	hutchib@host's password:
		+
		+	Before even entering a password, ''/usr/local/sbin/login_limit'' on ''host'' counts one login limit failure.
		+	# '''/usr/local/sbin/login_limit'''
		+	hutchib: 1 Tue Dec 11 12:01:41 2007 No Timeout Set
		+
		+	''syslog'' message:
		+	Dec 11 12:01:41 host sshd[20260]: [ID 122574 auth.notice] pam_login_limit(auth): Unsuccessful attempt 1 for user 'hutchib'

	== Storing Passwords in MD5 Format ==		== Storing Passwords in MD5 Format ==

Hutch at 16:32, 11 December 2007

Hutch — Tue, 11 Dec 2007 16:32:00 GMT

←Older revision		Revision as of 16:32, 11 December 2007
Line 85:		Line 85:
	other password requisite pam_authtok_get.so.1		other password requisite pam_authtok_get.so.1
	other password requisite pam_authtok_check.so.1		other password requisite pam_authtok_check.so.1
-	'''other password requisite pam_history.so.1 func=$1$'''	+	'''other password requisite pam_history.so.1 history=24 func=$1$'''
	other password required pam_authtok_store.so.1		other password required pam_authtok_store.so.1

-	The '''func=$1$''' is used to store the passwords in MD5 format in the password history database. By default, they would be stored in ''crypt'' format with only 8 characters of significance.	+	The '''history=24''' option sets the password history to 24 instead of the default 5. This is actually not needed, as the value specified in ''mkhistory'' supersedes this value, but it prevents a syslog error message.
		+
		+	The '''func=$1$''' option is used to store the passwords in MD5 format in the password history database. By default, they would be stored in ''crypt'' format with only 8 characters of significance.

	The '''func=''' option is only available in COMSpamph for Solaris 9 and later. See the [http://www.comsmiths.com.au/pam/v1.05/COMSpam_1.05.release_notes.pdf Documentation and release notes] for more information.		The '''func=''' option is only available in COMSpamph for Solaris 9 and later. See the [http://www.comsmiths.com.au/pam/v1.05/COMSpam_1.05.release_notes.pdf Documentation and release notes] for more information.

Hutch at 16:04, 11 December 2007

Hutch — Tue, 11 Dec 2007 16:04:02 GMT

←Older revision		Revision as of 16:04, 11 December 2007
Line 168:		Line 168:
	With '''PasswordAuthentication no''':		With '''PasswordAuthentication no''':

-	$ '''ssh hutchib@~~sprcmdo001~~'''	+	$ '''ssh hutchib@host'''
	Password:		Password:
	Password:		Password:

Hutch at 15:12, 7 December 2007

Hutch — Fri, 07 Dec 2007 15:12:35 GMT

←Older revision		Revision as of 15:12, 7 December 2007
Line 1:		Line 1:
-	The following ~~steps are~~ for Solaris 9, although ~~are probably also~~ applicable for Solaris 2.6, 7, and 8. Solaris 10 has much better password controls built-in.	+	The following information is for a Solaris 9 system, although it should be applicable for Solaris 2.6, 7, and 8. Solaris 10 has much better password controls built-in, obviating the need for third-party PAM modules.

	== Password Aging ==		== Password Aging ==

Hutch: Solaris 9 Password Policy moved to Solaris Password Policy: Encompasses 2.6-9

Hutch — Fri, 07 Dec 2007 15:10:09 GMT

Solaris 9 Password Policy moved to Solaris Password Policy: Encompasses 2.6-9

←Older revision

Revision as of 15:10, 7 December 2007

Hutch at 15:09, 7 December 2007

Hutch — Fri, 07 Dec 2007 15:09:50 GMT

←Older revision		Revision as of 15:09, 7 December 2007
Line 173:		Line 173:
	Password:		Password:
	Permission denied (publickey,keyboard-interactive,hostbased).		Permission denied (publickey,keyboard-interactive,hostbased).
		+
		+	== Storing Passwords in MD5 Format ==
		+
		+	With Solaris 9 12/02 and later, user passwords may be stored in a format other than ''crypt_unix'' by modifying ''/etc/security/policy.conf''. Changing the default encryption algorithm allows passwords to have more than 8 significant characters; with ''crypt_unix'', ''password'' and ''password1'' are the same password.
		+
		+	To begin storing user passwords in ''crypt_bsdmd5'', make the following change in ''/etc/security/policy.conf''.
		+	#CRYPT_DEFAULT=__unix__
		+	'''CRYPT_DEFAULT=1'''

	== Links ==		== Links ==

Hutch: /* Password Length and Complexity */

Hutch — Fri, 07 Dec 2007 15:01:00 GMT

Password Length and Complexity

←Older revision		Revision as of 15:01, 7 December 2007
Line 39:		Line 39:
	== Password Length and Complexity ==		== Password Length and Complexity ==

-	The default Solaris install does provide ''pam_cracklib'' or ''pam_passwdqc''. If the default password complexity rules are insufficient, these PAM modules (preferably ''pam_passwdqc'') should be used.	+	Minimum password length is configured using the '''PASSLENGTH=''' value in ''/etc/default/passwd''.
		+
		+	The default Solaris install does not provide ''pam_cracklib'' or ''pam_passwdqc''. If the default password complexity rules are insufficient, these PAM modules (preferably ''pam_passwdqc'') should be used.

	Default password complexity rules from ''passwd''(1):		Default password complexity rules from ''passwd''(1):