starlingx/config-files
Code Issues Proposed changes

Enforce new password rules for linux os accounts

Browse Source 
Enforce new password rules for linux os accounts, the new rules are:
- Minimum 12 characters
- At least 1 Uppercase letter
- At least 1 number
- At least 1 special character
- Cannot reuse past 5 passwords

Test Plan:
PASS: Run fresh install of AIO-SX with complete bootstrap and unlock
      of the controller-0.
PASS: Run build-pkgs -c -p pam-config.
PASS: Run build-image.
PASS: Change password 5 times and then try to use the first password of
      the sequence again to verify if it is using password history.
PASS: Try password without at least 1 letter.
PASS: Try password without at least one number.
PASS: Try password without at least one special character.
PASS: Try password with less than 12 character and verify if it fails.
PASS: Access account and change password using serial console.

Story: 2011084
Task: 49821

Change-Id: Ia2629bbbc09038a9aa2a1742eca335e3d22bfaff
Signed-off-by: Karla Felix <karla.karolinenogueirafelix@windriver.com>
This commit is contained in:
Karla Felix
2024-03-26 17:56:12 -03:00
parent 5b7c2e704b
commit e14b91598f
1 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
pam-config/source-debian/common-password
View File

@@ -17,17 +17,17 @@
# here are the per-package modules (the "Primary" block)
################## Titanium Cloud Password Rules #######################
## Enforce a password containing atleast 1 lower case, 1 upper case, #
## 1 digit and 1 special character. Such a password will have a #
## minimum length of 7 characters. A user may not re-use the last most #
## recent password and every password must differ from its previous #
## one by atleast 3 characters #
## - Added enforce_for_root for pam_pwquality.so #
########################################################################
################## System Password Rules ##########################
## Enforce a password containing atleast 1 lower case, 1 upper case, #
## 1 digit and 1 special character. Such a password will have a #
## minimum length of 12 characters. A user may not re-use the 5 last most #
## recent password and every password must differ from its previous #
## one by atleast 3 characters #
## - Added enforce_for_root for pam_pwquality.so #
###########################################################################
password required pam_pwquality.so try_first_pass retry=3 authtok_type= difok=3 minlen=7 lcredit=-1 ucredit=-1 ocredit=-1 dcredit=-1 enforce_for_root debug
password required pam_pwhistory.so use_authtok enforce_for_root remember=3 retry=3 debug
password required pam_pwquality.so try_first_pass retry=3 authtok_type= difok=3 minlen=12 minclass=4 ocredit=-1 lcredit=-1 ucredit=-1 dcredit=-1 enforce_for_root debug
password required pam_pwhistory.so use_authtok enforce_for_root remember=5 retry=3 debug
password sufficient pam_unix.so sha512 use_authtok debug
password [success=done authtok_err=die perm_denied=die default=ignore] pam_sss.so use_authtok