3

I am working on an embedded Linux distro.

I am trying to enforce a password policy through the pam_cracklib.so module

I modified the /etc/pam.d/common-password file, that now looks likethis:

password        required                        pam_cracklib.so minlen=10
password        [success=1 default=ignore]      pam_unix.so obscure  sha512 use_authtok
password        requisite                       pam_deny.so
password        required                        pam_permit.so

So I am trying to enforce a "password of at least 10 characters" policy, but nevertheless, inserting "a" as a password is notified as a bad password but not refused:

passwd
New password:   #inserted a
BAD PASSWORD: it is WAY too short
BAD PASSWORD: is a palindrome
Retype new password: #inserted a
passwd: password updated successfully #It should refuse such a weak password

Any tips?

Edit 1: as suggested by @berndbausch, syslog delta (including only the part after changed the password) after adding debug option to pam_cracklib.so is:

May  3 13:00:01 namc8569-xe1 audit[3084]: AVC avc:  denied  { read write } for  pid=3084 comm="passwd" path="/dev/pts/0" dev="devpts" ino=3 scontext=root:sysadm_r:passwd_t:s0 tcontext=root:object_r:devpts_t:s0 tclass=chr_file permissive=1
    May  3 13:00:01 namc8569-xe1 audit[3084]: SYSCALL arch=14 syscall=11 success=yes exit=0 a0=1011fae0 a1=1011fb18 a2=1011fd18 a3=ff8368c items=0 ppid=3080 pid=3084 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="passwd" exe="/usr/bin/passwd.shadow" subj=root:sysadm_r:passwd_t:s0 key=(null)
    May  3 13:00:01 namc8569-xe1 audit: PROCTITLE proctitle="passwd"
    May  3 13:00:01 namc8569-xe1 audit[3084]: AVC avc:  denied  { write } for  pid=3084 comm="passwd" name="dev-log" dev="tmpfs" ino=1169 scontext=root:sysadm_r:passwd_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=1
    May  3 13:00:01 namc8569-xe1 audit[3084]: AVC avc:  denied  { sendto } for  pid=3084 comm="passwd" path="/run/systemd/journal/dev-log" scontext=root:sysadm_r:passwd_t:s0 tcontext=system_u:system_r:init_t:s0-s15:c0.c1023 tclass=unix_dgram_socket permissive=1
    May  3 13:00:01 namc8569-xe1 audit[3084]: SYSCALL arch=14 syscall=102 success=yes exit=0 a0=3 a1=bff25db4 a2=6e a3=60 items=0 ppid=3080 pid=3084 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="passwd" exe="/usr/bin/passwd.shadow" subj=root:sysadm_r:passwd_t:s0 key=(null)
    May  3 13:00:01 namc8569-xe1 audit: PROCTITLE proctitle="passwd"
    May  3 13:00:01 namc8569-xe1 audit[3084]: AVC avc:  denied  { ioctl } for  pid=3084 comm="passwd" path="/dev/pts/0" dev="devpts" ino=3 scontext=root:sysadm_r:passwd_t:s0 tcontext=root:object_r:devpts_t:s0 tclass=chr_file permissive=1
    May  3 13:00:01 namc8569-xe1 audit[3084]: SYSCALL arch=14 syscall=54 success=yes exit=0 a0=0 a1=402c7413 a2=bff25828 a3=1001d090 items=0 ppid=3080 pid=3084 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="passwd" exe="/usr/bin/passwd.shadow" subj=root:sysadm_r:passwd_t:s0 key=(null)
    May  3 13:00:01 namc8569-xe1 audit: PROCTITLE proctitle="passwd"
    May  3 13:00:05 namc8569-xe1 systemd[1]: dev-ttyEHV0.device: Job dev-ttyEHV0.device/start timed out.
    May  3 13:00:05 namc8569-xe1 systemd[1]: Timed out waiting for device dev-ttyEHV0.device.
    May  3 13:00:05 namc8569-xe1 systemd[1]: Dependency failed for Serial Getty on ttyEHV0.
    May  3 13:00:05 namc8569-xe1 systemd[1]: [email protected]: Job [email protected]/start failed with result 'dependency'.
    May  3 13:00:05 namc8569-xe1 systemd[1]: dev-ttyEHV0.device: Job dev-ttyEHV0.device/start failed with result 'timeout'.
    May  3 13:00:05 namc8569-xe1 systemd[1]: Reached target Login Prompts.
    May  3 13:00:05 namc8569-xe1 systemd[1]: Reached target Multi-User System.
    May  3 13:00:05 namc8569-xe1 systemd[1]: Starting Update UTMP about System Runlevel Changes...
    May  3 13:00:05 namc8569-xe1 audit[1]: USER_AVC pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0-s15:c0.c1023 msg='Unknown class service exe="/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
    May  3 13:00:05 namc8569-xe1 audit[1]: USER_AVC pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0-s15:c0.c1023 msg='Unknown class service exe="/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
    May  3 13:00:05 namc8569-xe1 audit[3090]: SYSTEM_RUNLEVEL pid=3090 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0-s15:c0.c1023 msg='old-level=N new-level=3 comm="systemd-update-utmp" exe="/lib/systemd/systemd-update-utmp" hostname=? addr=? terminal=? res=success'
    May  3 13:00:05 namc8569-xe1 systemd[1]: Started Update UTMP about System Runlevel Changes.
    May  3 13:00:05 namc8569-xe1 systemd[1]: Startup finished in 1.703s (kernel) + 1min 31.908s (userspace) = 1min 33.612s.
    May  3 13:00:05 namc8569-xe1 audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0-s15:c0.c1023 msg='unit=systemd-update-utmp-runlevel comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
    May  3 13:00:05 namc8569-xe1 audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0-s15:c0.c1023 msg='unit=systemd-update-utmp-runlevel comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
7
  • Try the debug option of pam_cracklib.so. Commented May 4, 2021 at 8:52
  • Hi @berndbausch, do you mean adding debug to pam_cracklib.so line? So pam_cracklib.so debug minlen=10?
    – EagleOne
    Commented May 4, 2021 at 9:35
  • 1
    I don't know; I hoped debugging would help, but this log doesn't seem to contain anything from cracklib. Commented May 4, 2021 at 10:17
  • 2
    Did you test that with a regular (not uid 0) user ? or just root (which can set its password to whatever it pleases) Commented May 4, 2021 at 10:24
  • 1
    Ok, so I tried to do such password change with another user ad password policy is correctly enforced. I think the problem was that root can bypass such security checks. I think now it's solved, thanks
    – EagleOne
    Commented May 4, 2021 at 10:32

1 Answer 1

3

root (or any user with uid 0) can change its password to whatever is needed, usually (see below).

Try testing with a regular (not uid 0) user

@LL3 added this important info: "Note that it actually is still a matter of policy, because it is pam_cracklib itself that does not return "failure" if the account is root. See the enforce_for_root option of pam_cracklib"

3
  • thx a lot, @LL3. I shall edit my answer (or you could post i?) Commented May 4, 2021 at 11:26
  • I definitely want to credit you, as I did not check for this (and it is an important part of the answer!) Commented May 4, 2021 at 11:30
  • 1
    Thank you, indeed the enforce_for_root option enforces the policy for root too
    – EagleOne
    Commented May 4, 2021 at 12:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .