1

In /etc/pam.d/common-password we have a line such as:

password [success=1 default=ignore] pam_unix.so sha512 rounds=200000

Meaning, whenever anyone sets their password, hash it with 200,000 rounds of SHA-512. This inherently slow hashing protects against dictionary and brute-force attacks by limiting the speed at which passwords can be tested.

For some accounts we might want to protect the password better, at the expense of slower hashing. Say, 500,000 rounds for an admin account, and 800,000 for root. But I have not been able to find any way to specify such per-user or per-group policies in PAM. Can this be done?

1

You can specify per-user or per-group policies through the pam_succeed_if module. Use the “goto” action (i.e. an integer instead of ok, ignore, etc.) to skip over a password setting for some users.

password [success=1] pam_succeed_if user ne 0
# Setting for root
password [success=1] pam_unix.so sha512 rounds=800000
# Setting for non-root
password [success=ok] pam_unix.so sha512 rounds=200000

(Warning: untested and I'm not fluent in PAM.)

  • Thanks for the pointer. Looks like I'll have to do some reading and experiments before I can vote on it. – Tom Zych Mar 18 '16 at 7:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.