And yes,
we're going to dive out to our command line now where we're
all going to get a little bit of experience of controlling
our default password complexity.
So we're going to be investigating how this is configured, and we're going
to see then it's inside of our common‑password file.
We'll be looking at our pam_unix module and then taking
a look at our historical passwords, those passwords that we've previously used.
So when you're ready,
let's find that command line. And look at this, the glorious
command line where we're going to learn a little bit more about the
password complexity in our Linux systems,
especially this Ubuntu 20.04 system.
Now the password complexity is controlled by PAM, our pluggable
authentication modules, and we can use our good friend grep to look for
lines beginning with lowercase password, and we can search then our
/etc/pam.d subdirectory for our common‑password file.
When we go through then and execute our search,
we should find that we've got three lines coming back.
This is the way it's configured on the Ubuntu 20.04 system.
The most critical line for us is that first line where we're using the
pam_unix module, and we've got 2 options, the obscure and sha512,
which sha512 is easy enough, that's the algorithm that's being used to
hash our password. But obscure might be a little bit more difficult
for us to understand.
So if we want to investigate that, we can look inside
the man page for the documentation.
When we look inside of that, though, we can search inside of our man page,
but additionally, a cool feature of our command line is that we can
actually pipe the output of the man page directly through to less, and less
does have a facility where we can search outside of the less program
directly for the text that we want.
So here we're piping the output of the man page through to less, and we're
going to use + and /, then the string we want to search for, and the nice
thing is, we can see on the screen in front of us,
we're not inside the man page now. So we're
searching then for our option obscure,
hit the big Enter key, and of course, then, we are
nicely taken to the matching line.
Now what works well for us is it's the first occurrence of the word obscure,
but it might not work so well in other occurrences, but certainly giving us the
help that we want. And we can see then that it's working in cahoots with
pam_cracklib, which is then preventing dictionary words from being used, but
we're also checking that it's not a palindrome, we haven't just changed the
case, that it's not too similar to the previous word, it's not too simple, so
we have to have a mix of characters, and it's not just rotated from the old
password.
So this is what the obscure option is doing, and it's reminding us
that there are man pages for pretty much everything, and we can go
through and investigate the documentation.
Ah, that evil word! We can just quit out of our less program there, and we
can see then our password in action if we want. If we go through and switch
to our Ubuntu account, so su ‑, and then ubuntu, set up our password, so
obviously our current password, and then if we want to change our password
with the default complexity rules in place, we can go ahead and use passwd.
Now, of course, we've got to know our current password, so always read the
screen as well.
There it's asking us for our current password, not our new password. So
we can add in our current password, and then if we try a really simple
1234 for our new password and then repeat that, that is saying that we
don't meet the length requirement.
So if I then go through and put a new password of 123456,
I'm going to meet the length requirement.
So let's add that in again.
But then it's too simple.
I don't have the complexity of mixed characters. But if I now go
through and make sure that I've got a mix of characters, and I've
got at least six characters in place, we should be able to set our
password. So as I go through then and enter it and try and enter it
correctly again, we've now updated our password and we're good to go.
But of course, all of this is the default complexity rules.
If we want to then go through and take a look and maybe change some of this,
we can go through and edit then the file that we correct before, so
/etc/pam.d, and our common‑passwd, or password, when I then open up
this, if we move down to that first password line,
this is where all of the trickery is taking place.
We can go ahead, and if we don't want then the obscure option,
if we want to remove that level of password complexity,
we can go through and remove it. And we can also add in an option. Let's put
our minimum length and have that just to 4 characters.
And we're really doing this for demonstration; I'm not suggesting that this
becomes a viable option, so no complexity and only 4 characters.
But you can see now the immediate effect this is going to have
when I run my passwd command. I can enter the current password,
so that was with the complexity rules.
So let's carefully type that in. But my new password now can be 1234.
And retype it, this is now quick and easy, and it makes life very easy
for me as a user, but obviously, it's the security of the server that
we have to consider as well.
So don't just pander to the needs of your users. We have
to be able to allow security, but also allow our users to
be able to set the passwords.
So sometimes it's a matter of perhaps even moving away from
password authentication if it is becoming an issue.
But if I go through and take a look at the /etc/security/opasswd file,
it's empty at the moment because we're not storing any of our old passwords,
we only have our current password in our shadow file.
So if I want to stop users setting passwords they've previously
used, I can configure password history. Again, to do this, we're
going to drop back into that same file.
So I'm going to edit my common‑password file again, and maybe we
need to add some of our security requirements in again. This time
I'm setting a minimum length to 8 characters, and we're going to
set our obscure back in.
But we also want to prevent users from changing to passwords
they've previously used, and this then becomes the option remember=
and then however many passwords you want to be stored in the last
epoch, the area that we're testing. So we're going to keep 10
passwords for each user.
So if I now go through and save this, this is effective immediately,
no restart of services. Now as my user, if I go through and set my
current password, now as I go through and set my new password,
meeting the minimum requirements of 8 characters and the complexity
rules of mixing case and numbers, carefully retype that password,
then that is done.
So I've met the password requirement, and I've set a more secure password.
I need to set another password because automatically you're not allowed to
go to the current password that you've got.
But that current password now is in my password history as well.
But if I then skip one more password, so if I set a new password now
again to the password requirement, I'm going to be able to show you
that we actually store our password history.
So let's give this a go. With passwd, set my complex password, so this is
the one that I've just set. My new password has to be different to it in any
case, so that wouldn't really test my history.
So I set another one based on the same complexity rules, but it's a different
password. So that's good to go. But we are populating the old password file. So
we've got then my two old passwords now are stored. If I try and set the first
old password, that's going to be prevented.
So, passwd, my current password, which is Biology1 with a capital B.
I've got a stunning plan to remember these passwords! If I sent my new
password to be History1 with an uppercase.
H, that was the first complex password that I used when we were remembering our
history, and set History1 again, and then it's not going to allow me, so it's
been previously used. So I have to set another one.
Don't worry, I've got another subject and another number, so I can
set Geography1, carefully typing that, and then going through and
typing it again all very carefully.
And then as I add that in again, then I should be able to set that.
So I've got three passwords in my history, History1, Biology1, and Geography1.
Now we're not going to be able to see their values, but if I go through and cat
out the /etc/security, and then /opasswd file, we can see that the Ubuntu user
has had three passwords stored in its history.
And we can see then each one of those passwords, so we can then do checks to see if they have been previously used.