Setting Password Restrictions UNIX Lines of Defense

•

8.2.3 Setting Password Restrictions

Breaking a password is a time−consuming job; good UNIX administration makes this job even more difficult. One of the ways to accomplish this is to force users to follow the established guidelines for safer passwords. These criteria are primarily related to the password time restrictions known as password aging and the password contents. A periodic change of the password is an important step in password protection against attackers. A broken password is useless for an intruder if the password was changed after the break. However, no one likes to change passwords; once a user becomes familiar with the password it can be difficult to change it and learn a new one. Modern UNIX flavors, however, provide mechanisms whereby users can be forced to make these changes. An administrator can specify a maximum password lifetime to force a user to change passwords after a certain period of time, minimum password time to force a user to keep a new password for a certain period of time, the minimum password length, and sometimes other parameters. Setting a minimum and maximum password lifetime is referred to as specifying the password aging. Old−fashioned UNIX flavors were not as concerned about password restrictions; this concept came later with other security improvements, when experiences in UNIX usage taught UNIX designers about existing real−life security challenges. On UNIX platforms, restrictions are introduced by using the passwd command with various options. A few options, not necessarily supported by all UNIX flavors, are: Option Meaning Example −f Force the user to change the password on the next login passwd −f username −n Specify a minimum password life time the password cannot be changed during this time passwd –n 1 username −x Specify a maximum password time the password must be changed after this time passwd –x 158 username password aging may vary between 1 and 158 days −l Lock a password so the user cannot login passwd −l username 194 Password aging is a questionable issue. Too−frequent password changes could be counterproductive. It is easy to forget a new password, and it could be a new burden for the administrator only the superuser can change a users forgotten password. The administrator should carefully consider how many of the available restrictions should be used on a specific system. Imposing too many password restrictions, sometimes pejoratively called password fascism, tends to be very unpopular among users and carries some hidden disadvantages. Obviously, all aspects of setting password restrictions should be seriously considered before any final decision is made. Luckily, UNIX is sufficiently flexible to meet almost any need.

8.2.4 A Shadowed Password