It is essential to establish an effective security policy for Oracle software owner
users. In this recipe we will talk about managing complex password rules that can primarily prevent brute force attacks. Restriction of using previous passwords and too similar passwords is an additional security measure which can be implemented to prevent undesired access into the system.
Password rule checking and restriction of the use of previous passwords is performed by Pluggable Authentication Module, or simply known as PAM, discussed in this recipe. In these days PAM is available and used on all major Linux and Unix distributions. The differences in implementation on these platforms are minimal.
root
open /etc/pam.d/system-auth
for editing. Modify the line that begins with password requisite pam_cracklib.so
, with the following line:password requisite pam_cracklib.so try_first_pass retry=3 minlen=12 lcredit=-2 ucredit=-2 dcredit=-1 ocredit=-1
oracle
user and change the password to a strong password, such as of24UT()next(1)=2
:[oracle@nodeorcl1 ~]$ passwd Changing password for user oracle. Changing password for oracle (current) UNIX password: New UNIX password: Retype new UNIX password: passwd: all authentication tokens updated successfully.
/etc/security/opasswd
file and set its permission to 600
. This file will retain the used password history for comparisons:[root@nodeorcl1 security]# touch /etc/security/opasswd ; chmod 600 /etc/security/opasswd
/etc/pam.d/system-auth
file and modify the line added in step 4 by appending the difok
parameter and remember
parameter at the end of the line beginning with password sufficient pam_unix.so
as follows: password requisite pam_cracklib.so try_first_pass retry=3 minlen=12 lcredit=-2 ucredit=-2 dcredit=-1 ocredit=-1 difok=6 password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=10
oracle
and change the password. Try to set the password as the same password used before. The PAM module will detect that the password is unchanged as we can see from the following listing:[oracle@nodeorcl1 ~]$ passwd Changing password for user oracle. Changing password for oracle (current) UNIX password: New UNIX password: Password unchanged New UNIX password
[oracle@nodeorcl1 ~]$ passwd Changing password for user oracle. Changing password for oracle (current) UNIX password: New UNIX password: BAD PASSWORD: is too similar to the old one Finally use a strong password (Ty%u60i)R_"Wa?) with more than three different characters as follows: [oracle@nodeorcl1 ~]$ passwd Changing password for user oracle. Changing password for oracle (current) UNIX password: New UNIX password: Retype new UNIX password: passwd: all authentication tokens updated successfully. [oracle@nodeorcl1 ~]$
It is highly recommended to perform security assessments regularly on your system. To check your real password's strength you should try to use a password cracker.
For a list and description of some of the best available password crackers consult http://nrupentheking.blogspot.com/2011/02/best-password-crackers-in-hackers.html.
Some recommendations for generating strong passwords:
The Linux PAM module pam_cracklib.so
checks the password against dictionary words and other constraints using minlen
, lcredi
, ucredi
, dcredit
, and ocredit
parameters, which are defined as follows:
To restrict the use of a previous password, the system must save the used passwords to use them for comparison. The file used for storing previous passwords is called opasswd
. In case it does not exist, it must be created in the /etc/security
directory. The restrict enforcement is performed in stacking mode by combining the remember
parameter of the pam_unix.so
module with the
difok
parameter of the pam_cracklib.so
module. The remember
parameter will configure the number of previous passwords that cannot be reused, and difok
is used to specify the number of characters that must be different between the old and the new password.
PAM configuration files on Red Hat Linux and variants are located in /etc/pam.d
directory. The service shares the same name as the application designed to authenticate; for example the PAM configuration file for the su
command is contained in a file with the same name (/etc/pam.d/su
).
Next, we will take a look at the PAM configuration file format. To understand this we will use the line corresponding to the password module modified in this recipe:
password requisite pam_cracklib.so try_first_pass retry=3 minlen=12 lcredit=-2 ucredit=-2 dcredit=-1 ocredit=-1
The first directive is the module type. A brief summary of module types and how PAM enforces the rules is as follows:
The second directive from the PAM configuration files is represented by control flags. These flags tell what to do with the result returned by a module. All PAM modules return a success or failure result when called.
The third directive is the pluggable module. The next parameters represent the arguments passed to the pluggable module.
You can bypass PAM rules for password enforcement as root; hence the passwords to comply with the enforcement rules must be changed by each user.
[root@nodeorcl1 run]# make clean linux-x86-64
/etc/password
and /etc/shadow
into a separate file, /tmp/passwd.db
:[root@nodeorcl1 run]# ./unshadow /etc/passwd /etc/shadow > /tmp/passwd.db
[root@nodeorcl1 run]# ./john /tmp/passwd.db
Loaded 3 password hashes with 3 different salts (FreeBSD MD5 [32/64 X2]) testuser (testuser) root1234 (root) guesses: 3 time: 0:00:00:00 100% (1) c/s: 2150 trying: Root999 - root1234 Use the "--show" option to display all of the cracked passwords reliably [root@nodeorcl1 run]#
18.189.180.43