h49876 s 00002/00002/00393 d D 1.10 98/10/14 09:40:59 clyde 10 9 c Update history_admin examples e s 00005/00005/00390 d D 1.9 98/07/20 15:42:33 clyde 9 8 c Spell check e s 00032/00009/00363 d D 1.8 98/07/20 14:41:14 clyde 8 7 c Add stuff about history database owner and mode e s 00011/00006/00361 d D 1.7 98/07/16 14:51:00 clyde 7 6 c Add comment about history database ownerships e s 00021/00016/00346 d D 1.6 98/07/16 09:13:00 clyde 6 5 c Update path tokens e s 00010/00014/00352 d D 1.5 98/07/09 15:28:31 clyde 5 4 c Use path tokens and fix links e s 00043/00059/00323 d D 1.4 98/07/08 17:01:39 clyde 4 3 c Another cleanup pass e s 00005/00005/00377 d D 1.3 98/07/02 15:43:53 clyde 3 2 c Change name and fix a link e s 00002/00002/00380 d D 1.2 98/06/30 10:33:05 clyde 2 1 c Change title e s 00382/00000/00000 d D 1.1 98/06/26 09:56:36 clyde 1 0 c date and time created 98/06/26 09:56:36 by clyde e u U f e 0 t T I 1
D 2Npasswd subjects password candidates to a series of guessability tests. The password is accepted only if it passes all of them.
Which tests are used and the order of application is customizable in the configuration file. Some tests are mandatory, and others optional (as noted below).
The password tests are:
Password history discourages too frequent password reuse.
Password candidates are compared to the passwords in the users' history and rejected if found. When a password change is done, the encrypted new password is stored in the history database. D 7
The history database should generally be accessible only D 3 to root. See below for details. E 3 I 3 to root. See below for details. E 3 Should the database fall into hostile hands, the security E 7 I 7 D 8
Access to the history database is restricted. E 8 I 8
Access to the history database should be restricted. E 8 However, should the database fall into hostile hands, the security E 7 exposure would be minimal. Passwords in the history got there because npasswd was happy with them, hence they should be hard to guess. I 7 See below for details. E 7
The password history database location and storage method can be specified in the configuration file. The history methods available are:
See also: The password history section of the Npasswd Reference Manual.
See also: D 5 The password checking E 5 I 5 The password checking E 5 section of the Npasswd Reference Manual.
The candidate is examined to see if it is derived from the users' passwd information.
See also:
The dictionary
section of the Npasswd Reference Manual.
Crack, the most popular password guessing program, makes extensive use of word collections. Each word is permuted in various ways, encrypted and compared to the target cyphertext. The more words that Crack has available, the more passwords it will guess.
The primary function of npasswd is to frustrate bad guys running Crack. To this end, some of Crack has been incorporated into npasswd.
D 4 Dictionaries are a set of hash files optimized for fast lookups. E 4 I 4 Dictionaries are a set of hash files optimized for fast lookup. E 4 They are constructed from word lists, which are text files with one word per line. D 4 The dictionary hash files are created via E 4 I 4 The dictionary hash files are created with E 4 D 5 makedict, which E 5 I 5 makedict, which E 5 produces files with the suffixes .pwd, .pwi and .hwm. The hash files are probably are not portable between CPU architectures, and take up more disk space their source data.
D 4 These hash files normally live in the main dictionary directory (npasswd-lib/dictionaries), but can be placed elsewhere E 4 I 4 The dictionary hash files normally live in the dictionary directory D 6 (@NPASSWD-DICTS), but can be placed elsewhere E 6 I 6 (@NPASSWD-DICT@), but can be placed elsewhere E 6 E 4 and pointed to in the D 4 configuration file. E 4 I 4 configuration file. Multiple dictionary directories can be given. E 4
To make a dictionary accessible to npasswd, copy the hash files (or make symlinks) into the appropriate directory. The files should be world-readable. Npasswd will reject any dictionary with a world-writable hash file.
You can have numerous dictionaries, each generated from a distinct group of words (the suggested way), or one large dictionary.
The more dictionary words available to npasswd, the fewer passwords it will accept. The passwords it does accept will be harder (but not impossible) to guess. The downside is that users may get more frustrated trying to think up acceptable passwords.
There is more about password checking and dictionaries in the D 5 Frequently Asked Questions. E 5 I 5 Questions And Answers. E 5
D 4 The makedict and unpacker programs are in the npasswd install directory. E 4 I 4 D 5 The makedict and unpacker programs are in @NPASSWD-LIB@. E 5 E 4
To convert a Crack dictionary:
To make a new dictionary:
To add words to an existing dictionary:
To remove a dictionary:
To view the contents of a dictionary:
The password history mechanism controls password reuse. If the history mechanism is active, npasswd fetches the password history for a D 4 user and compares the candidate to each password in the history. E 4 I 4 user and compares the candidate to the active passwords in the history. A password is active if it is younger than the age limit and within the depth limit.
The age and depth limits can be set in the configuration file.
The history mechanism is inactive unless the database file(s) exist. D 7 Explicit action is required to enable it. Use the D 5 history_admin E 5 I 5 history_admin E 5 utility to manage password history. E 7 I 7 The installation process does not create the database. Use the history_admin utility to create and manage the database.
D 8 The history database file(s) are protected to be read-write by owner and read-only by the group selected during package configuration. Programs needing read-only access to the database (e.g. checkpassword) are installed set-gid to this gid. E 7 E 4 D 4
The history mechanism is inactive unless the database file(s) exist. Explicit action is required to enable it. Use the history_admin utility to manage the password history mechanism.
There are two criteria for what passwords are active in the history:
I 8 By default the history database file(s) are created read-write only by owner (typically root). This is done to shield the old passwords from public view, even though D 9 npasswd was happy with them so they should be less susecptible to E 9 I 9 npasswd was happy with them so they should be less susceptible to E 9 being guessed.
For other programs to access the history database (e.g. checkpassword) they may need to run as root. It is not advisable to install D 9 checkpasword as set-uid to root (though it will behave properly if setuid). A suggested solution is below. E 9 I 9 checkpassword as set-uid to root (though it will behave properly). A suggested solution is below. E 9
E 8 D 4 There are special considerations in locating the history database. If a system is part of a cluster which shares a password file, the password history database must on a shared file system to which the other cluster members can write, preferably with root permission. E 4 I 4 If npasswd is being used on a member of a cluster which shares a password file, the password history database must in a directory which the other cluster members mount and can write to, preferably with root access. E 4 D 4
If this is not possible, change the ownership of the history database files to a non root user. If npasswd cannot update the history database as root, it will attempt to use setreuid(2) to temporarily change effective uid to the owner of the database and try again to update it. E 4 I 4
An alternative is to make the history database owned by a non-root user (this works around NFS root access issues). In that case, npasswd will attempt to use setreuid(2) to temporarily change its effective uid to the owner of the database to update it. E 4 D 8 E 8 D 4
The password history mechanism should support something other than files, and there is untested code stubbed in for using NIS. The proper solution would be RPC-based, but that is a lot of work which even the systems that support password history (e.g. Digital UNIX), have not done. E 4
I 8 Here is how to change the ownership of the history database:
# # If you are creating the history from scratch # @NPASSWD-HOME@/history_admin -v load < /dev/null # The confirmation message includes the history database path chown new-owner history-file* # # If you want checkpassword to access the history database, do # cd @NPASSWD-SRC@/src/PasswordCheck make CHECKPW_MODE=4111 CHECKPW_FLAGS="-o new-owner" checkpassword-install
E 8
D 9
The history database requires periodic maintenance. Old and excess passwords, and entries for users no longer in the password file need removing. Periodically (weekly or monthly), D 5 run history_admin E 5 I 5 run history_admin E 5 from cron. Make this purge a part of what is done upon deleting users from the password file.
To create the default database:
Populating alternate DBM database from a file:
To purge the default database with the default limits:
To purge the default database with the default limits:
To ignore the configuration file settings:
D 4
The following files and directories are installed as part of npasswd. All of these files (except the configuration file) can be relocated by directives in the configuration file.
D 3 The path /usr/lib/passwd can be changed by re-running Configure. E 3 I 3 D 4 The path /usr/lib/passwd can be changed by re-running Configure. E 4 I 4 D 6 The path @NPASSWD-LIB@ can be changed by re-running E 6 I 6 The path @NPASSWD-HOME@ can be changed by re-running E 6 Configure. E 4 E 3
Default location | What it is | |||
---|---|---|---|---|
/usr/lib/passwd | E 4 I 4 D 6@NPASSWD-LIB@ | E 6 I 6@NPASSWD-HOME@ | E 6 E 4Directory where all the parts live | |
/usr/lib/passwd/xbin | E 4 I 4@NPASSWD-XBIN@ | E 4Directory where vendor utilities are saved | ||
/usr/lib/passwd/dictionaries | Directory where the hashed Crack dictionaries live | E 4 I 4 D 6@NPASSW-DICTS@ | E 6 I 6@NPASSWD-DICT@ | E 6Main repository for hashed dictionary files | E 4
/usr/lib/passwd/doc | E 4 I 4 D 6@NPASSWD-LIB@/doc | E 6 I 6@NPASSWD-DOCS@ | E 6 E 4Directory for npasswd documentation | |
/usr/lib/passwd/passwd.conf | E 4 I 4 D 6@NPASSWD-LIB@/passwd.conf | E 6 I 6@NPASSWD-UTIL@ | D 9Directory for miscellanous programs | E 9 I 9Directory for miscellaneous programs | E 9
@NPASSWD-HOME@/passwd.conf | E 6 E 4The npasswd configuration file | |||
/usr/lib/passwd/chfn.help
/usr/lib/passwd/chfn.motd |
E 4
I 4
D 6
@NPASSWD-LIB@/chfn.help
@NPASSWD-LIB@/chfn.motd |
E 6
I 6
@NPASSWD-HOME@/chfn.help
@NPASSWD-HOME@/chfn.motd |
E 6
E 4
Help and message-of-the-day for chfn sub-program | |
/usr/lib/passwd/chsh.help
/usr/lib/passwd/chsh.motd |
E 4
I 4
D 6
@NPASSWD-LIB@/chsh.help
@NPASSWD-LIB@/chsh.motd |
E 6
I 6
@NPASSWD-HOME@/chsh.help
@NPASSWD-HOME@/chsh.motd |
E 6
E 4
Help and message-of-the-day for chsh sub-program | |
/usr/lib/passwd/passwd.help
/usr/lib/passwd/passwd.motd |
E 4
I 4
D 6
@NPASSWD-LIB@/passwd.motd
@NPASSWD-LIB@/passwd.motd |
E 6
I 6
@NPASSWD-HOME@/passwd.motd
@NPASSWD-HOME@/passwd.motd |
E 6
E 4
Help and message-of-the-day for passwd sub-program | |
/usr/lib/passwd/history | E 4 I 4@NPASSWD-HIST@ | E 4Password history database |
Document id %Z% %M% %I%
Version %I%
Last modified %G%
Clyde Hoover