And this is another great one, isn't it?
The password quality.
Maybe we're setting a new password,
or maybe we're trying to change our existing password,
and whatever we do, we just feel incapable of setting our password.
And how brilliant do we feel after that?
I'm the chairman of the board.
It's certainly going to be a little of that, isn't it?
But we're going to take a look at what password quality is.
The default quality, if nothing else is installed,
is that we need to have a password with a minimum length of six characters.
We need at least one uppercase, one lowercase, and a number.
There's some other entropy elements that are added in,
and we'll take a look at those.
When we take a look though at the default password complexity,
we can search, and it's configured within PAM.
If we search for lines beginning with password from the
common‑password file inside of etc and pam.d,
we should get three lines coming back.
It's the first line in Ubuntu that is controlling our password complexity.
The control is being maintained by the pam_unix.so module,
and we can look inside of the man page.
If we want to look at where the complexity is coming from,
then it's the obscure option.
If we want to search directly, then this is a really cool option,
we can go through and open up our man page,
pipe the output to less, and then go through and search for obscure.
If we want to make our passwords perhaps a little bit easier.
We might be able to reduce the password length,
but, of course, when we're thinking about this,
we're not just doing it for the individual user,
it's for all users on our system,
so the security is really determined by the security
needs of the data on the server.
But we can edit our common‑password file,
and here we've removed the obscure option, so we don't
have the password complexity requirement,
and we've set a minimum length of just four characters.
Now this is more or less for demonstration purposes,
but just showing you that it can be done.
As we then take a look at what else we could do,
again,
the security of our passwords is really reflecting
what we need based on our servers.
But we might decide we need a little bit more security,
so we can also remember old passwords.
In this setting here,
we're going through and setting our minimum password length to be eight,
so slightly longer passwords than the default of six.
We've added in the obscure option again,
but additionally, we are now storing password history,
remembering the last five passwords that the user has had.
And they're going to be in our etc/security, an opasswd file for old passwords.
So with this then,
we've added a little bit extra security by increasing the length,
and we're remembering user's passwords.
But again,
we're likely to have more frustrated users when they
are trying to set their passwords.
But remember, we are trying to set it for the security needs of the server.
So why don't we dive out to our command line and take a look at how some of this is going to affect users in setting their passwords.