Enforcing a Strong Password Policy on Ubuntu Server

Enforcing a strong password policy on your Ubuntu server is a critical step towards securing your system. This article will guide you through the process of implementing a password complexity policy using the pam_cracklib module.

Introduction

Password complexity policies are rules that enforce the creation of robust passwords by users. These policies can require a mix of uppercase and lowercase letters, numbers, special characters, and a minimum password length.

In Ubuntu, we can enforce these policies using Pluggable Authentication Modules (PAM). One such module is pam_cracklib, which we’ll be using in this guide.

The pam_cracklib Module

The pam_cracklib module is a PAM module that checks password strength. It’s capable of enforcing password complexity requirements such as uppercase, lowercase, digits, and special characters.

Enforcing Password Complexity

Let’s start by enforcing password complexity on your Ubuntu server.

1. Open the PAM configuration file Open your terminal and type the following command to open the PAM configuration file in a text editor:

   sudo vi /etc/pam.d/common-password

   This command opens the file /etc/pam.d/common-password in the vi text editor with root privileges.
2. Modify the PAM configuration file In the opened file, add the following line before the pam_unix.so line:

   password requisite pam_cracklib.so ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1

   This line sets the password requirements as follows:
   • ucredit=-1: This enforces at least one upper-case character in the password.
   • lcredit=-1: This enforces at least one lower-case character in the password.
   • dcredit=-1: This enforces at least one digit in the password.
   • ocredit=-1: This enforces at least one special character in the password.
   You can adjust the -1 values to specify the minimum number of required characters for each category.
3. Save and exit Save the file and exit the text editor. With these changes, the pam_cracklib module will enforce the specified password complexity policy. Users will be required to create passwords that meet these criteria.

Additional Password Requirements

If you want to further restrict the password requirements, you can use additional variables like minlength and retries. For example:

password requisite pam_cracklib.so retry=3 minlen=10 difok=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1

This line sets a maximum of three attempts to create an acceptable password (retry=3), a minimum length of 10 characters (minlen=10), and requires at least three characters different from the previous password (difok=3).

Conclusion

Enforcing a strong password policy is an essential part of securing your Ubuntu server. By using the pam_cracklib module, you can ensure that users create robust passwords that meet specific complexity requirements. For more information and examples, refer to the pam_cracklib man pages and the article on setting up stronger password policy rules in Linux.

Remember, while a strong password policy is a good start, it’s just one part of a comprehensive security strategy. Always keep your system updated, monitor for unusual activity, and educate your users about good security practices.