Unix as a Second Language

Unix tip: Password complexity for users

On older Solaris systems, you would only see a few tunable parameters for controlling passwords. MINWEEKS determined the number of weeks that a user was required to keep his password. MAXWEEKS determined how many weeks could go by before he was forced to change it. And PASSLENGTH, of course, determined the minimum number of characters a password had to have to be accepted by the system. These settings limited the time that a user could keep a password and potentially kept him from changing his password on expiration and immediately changing it back to its original setting.

These settings are stored in several fields of the /etc/shadow file. The record below, for example, shows a password which just recently expired. It was last changed a little over a month ago (date), but was set to expire after 28 days (max). The user was prevented from changing his password within two weeks of setting it (min).

shs:K6be11OCyAwAY:14355:14:28::::
                   ^    ^   ^
                   |    |   |
                  date min max

These settings might look like this in the /etc/default/passwd file:

MAXWEEKS=4
MINWEEKS=2
PASSLENGTH=6

Beyond this, the passwd command required that users include at least two letters and at least one number of special character. If a user trying to change his password didn't follow these rules, he would see a message such as this one:

passwd: The first 6 characters of the password must contain at
least two alphabetic characters and at least one numeric or
special character.

Solaris 10 offers a suite of settings that provide a lot more control over users' password choices. These settings, stored in the /etc/default/passwd file, allow you to your own rules.

On installation, the /etc/default/passwd file on a Solaris 10 system will have this group of settings all commented out.

#MINDIFF=3
#MINALPHA=2
#MINNONALPHA=1
#MINUPPER=0
#MINLOWER=0
#MAXREPEATS=0
#MINSPECIAL=0
#MINDIGIT=0
#WHITESPACE=YES

These settings give you a lot of control over how passwords are set. The fields are used like this:

MINDIFF - Defines the minimum number of differences required between old and new passwords. If not set, it defaults to 3.
MINALPHA - Defines the minimum number of alphabetic characters. If not set, it defaults to 2.
MINNONALPHA - Defines the minimum number of non-alphabetic characters. In other words, digits and special characters. The default is one.
MINUPPER and MINLOWER - Define the minimum number of uppercase and lowercase characters required. Both default to 0. In other words, we might still require letters, but their case is not evaluated unless one of these settings is used.
MAXREPEATS - Determines the number of times you can consecutively use the same character (e.g., 111 or xxx).

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world