Date: Wed, 3 Oct 2018 13:21:45 +0200 From: Solar Designer <solar@...nwall.com> To: passwdqc-users@...ts.openwall.com Subject: Re: rules Hi Tomas, On Wed, Oct 03, 2018 at 10:52:54AM +0200, Tomas Hudik wrote: > i have a newbie question - my /etc/pam.d/common-password (ubuntu 18.04) > has lines: > > password requisite pam_passwdqc.so min=disabled,8,8,8,7 > passphrase=0 > password [success=1 default=ignore] pam_unix.so use_authtok obscure > sha512 > > However, when I try: > sudo passwd user > > to change password to "1234567i" (which is 2 classes: numbers, lowercase > and 8 characters) > fails. > Do you have why? Based on rules (min 8acharacters per 2 classes) should be > fine It probably tells you why. Here's how to obtain the same behavior without bothering with PAM yet, for testing: $ echo 1234567i | pwqcheck -1 min=disabled,8,8,8,7 passphrase=0 Bad passphrase (based on a common sequence of characters and not a passphrase) Here's how to disable the extra check to have that password accepted: $ echo 1234567i | pwqcheck -1 min=disabled,8,8,8,7 passphrase=0 match=0 OK So to achieve what you want, add match=0 to the line in /etc/pam.d/common-password. Testing the resulting somewhat weak policy on common passwords from JtR's default password.lst gives these accepted common passwords: $ grep -v '^#!comment:' /usr/share/john/password.lst | pwqcheck -1 --multi min=disabled,8,8,8,7 passphrase=0 match=0 | grep -n ^OK: 153:OK: asdfjkl; 233:OK: a1b2c3d4 731:OK: abcd1234 914:OK: jordan23 1218:OK: asdf1234 1309:OK: chris123 1453:OK: happy123 1467:OK: hello123 1704:OK: qwerty12 1921:OK: 1234qwer 1930:OK: apollo13 2037:OK: blink182 2040:OK: passw0rd 2044:OK: iloveyou! 2053:OK: 1q2w3e4r 2068:OK: 1qaz2wsx 2070:OK: monkey12 2072:OK: q1w2e3r4 2497:OK: ncc1701d 2530:OK: porsche911 2577:OK: ncc1701e 2841:OK: asdf;lkj 2964:OK: front242 3446:OK: good-luck 3453:OK: sample123 3486:OK: ChangeMe 3487:OK: Front242 Without the match=0 addition, it'd be only these 4: $ grep -v '^#!comment:' /usr/share/john/password.lst | pwqcheck -1 --multi min=disabled,8,8,8,7 passphrase=0 | grep -n ^OK: 2044:OK: iloveyou! 2497:OK: ncc1701d 2530:OK: porsche911 2577:OK: ncc1701e 3446:OK: good-luck Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.