PAM: password policy and lockout

Not running Starting usually ~20 s

Step 1 of 8 · on a machine · 4 min

A weak password gets through

Turn on the pwquality password check and set a policy in /etc/security/pwquality.conf.
Wire the faillock failed-login lockout into the PAM stack and set the deny threshold.
Verify the policy and the lockout by action and clear a lockout with faillock --reset.

A password is a server's first lock. Check what guards that lock on a fresh system.

A colleague has created the service account webadmin and asks you to change its password. He picks a short word — password.

Exercise · look

The webadmin service account currently has the password ServiceAcct-7. Change it to the dictionary word password the way the account owner would.

First, predict

webadmin changes their own password to the dictionary word password. Will the system accept it?

Now start the exercise, run the command and compare your prediction with the output.

Check yourself 1 question

The owner changed the password to password, and the system accepted it. Why did that happen?

The owner webadmin changed it themselves (sudo -u webadmin passwd), not root. It was the stack's loose check that accepted it.
There is no such rule: the stack would take a random password too. It just checks almost nothing.

The default stack checks the password loosely, and the eight-letter word went through.

Ubuntu 24.04