/srv/hg/libpwquality: Convert manual pages to pod format for eas...
by admin@fedoraproject.org
changeset 306324aced04 in /srv/hg/libpwquality
details: http://hg.fedorahosted.org/hg/srv/hg/libpwquality?cmd=changeset;node=3063...
summary: Convert manual pages to pod format for easier creation.
diffstat:
doc/man/Makefile.am | 14 +
doc/man/pam_pwquality.8 | 413 -------------------------------------------
doc/man/pam_pwquality.8.pod | 309 ++++++++++++++++++++++++++++++++
doc/man/pwmake.1 | 45 ----
doc/man/pwmake.1.pod | 48 ++++
doc/man/pwquality.conf.5 | 133 -------------
doc/man/pwquality.conf.5.pod | 123 ++++++++++++
doc/man/pwscore.1 | 48 ----
doc/man/pwscore.1.pod | 51 +++++
9 files changed, 545 insertions(+), 639 deletions(-)
diffs (1223 lines):
diff -r b4f44d75bcba -r 306324aced04 doc/man/Makefile.am
--- a/doc/man/Makefile.am Fri Jul 17 17:08:43 2015 +0200
+++ b/doc/man/Makefile.am Wed Jul 22 16:41:01 2015 +0200
@@ -3,3 +3,17 @@
if HAVE_PAM
dist_man_MANS += pam_pwquality.8
endif
+
+EXTRA_DIST=pam_pwquality.8.pod pwmake.1.pod pwscore.1.pod pwquality.conf.5.pod
+
+%.8: %.8.pod
+ bash -c 'declare -u ucname=$*; pod2man --utf8 --name="$$ucname" --section=8 --center="Linux-PAM Manual" --release="Red Hat, Inc." $< $@'
+
+%.1: %.1.pod
+ bash -c 'declare -u ucname=$*; pod2man --utf8 --name="$$ucname" --section=1 --center="General Commands Manual" --release="Red Hat, Inc." $< $@'
+
+%.5: %.5.pod
+ bash -c 'declare -u ucname=$*; pod2man --utf8 --name="$$ucname" --section=5 --center="File Formats Manual" --release="Red Hat, Inc." $< $@'
+
+manclean:
+ rm *.8 *.1 *.5
diff -r b4f44d75bcba -r 306324aced04 doc/man/pam_pwquality.8
--- a/doc/man/pam_pwquality.8 Fri Jul 17 17:08:43 2015 +0200
+++ /dev/null Thu Jan 01 00:00:00 1970 +0000
@@ -1,413 +0,0 @@
-.\" Escape single quotes in literal strings from groff's Unicode transform.
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.de FN
-\fI\|\\$1\|\fP
-..
-.TH PAM_PWQUALITY 8 "16 Jul 2015" "Red Hat, Inc."
-.SH NAME
-pam_pwquality \- PAM module to perform password quality checking
-.SH SYNOPSIS
-\fBpam_pwquality\&.so\fR [\fI\&.\&.\&.\fR]
-.SH DESCRIPTION
-.PP
-This module can be plugged into the
-\fIpassword\fR
-stack of a given service to provide some plug\-in strength\-checking
-for passwords\&. The code was originally based on pam_cracklib module
-and the module is backwards compatible with its options\&.
-.PP
-The action of this module is to prompt the user for a password and check
-its strength against a system dictionary and a set of rules for identifying
-poor choices\&.
-.PP
-The first action is to prompt for a single password, check its strength
-and then, if it is considered strong, prompt for the password a second time
-(to verify that it was typed correctly on the first occasion)\&. All being
-well, the password is passed on to subsequent modules to be installed as the
-new authentication token\&.
-.PP
-The strength checks works in the following manner: at first the
-\fBCracklib\fR
-routine is called to check if the password is part of a dictionary; if this
-is not the case an additional set of strength checks is done\&. These checks
-are:
-.PP
-Palindrome
-.RS 4
-Is the new password a palindrome?
-.RE
-.PP
-Case Change Only
-.RS 4
-Is the new password the the old one with only a change of case?
-.RE
-.PP
-Similar
-.RS 4
-Is the new password too much like the old one? This is primarily controlled
-by one argument,
-\fBdifok\fR
-which is a number of character changes (inserts, removals, or replacements)
-between the old and new password that are enough to accept the new
-password\&.
-.RE
-.PP
-Simple
-.RS 4
-Is the new password too small? This is controlled by 6 arguments
-\fBminlen\fR,
-\fBmaxclassrepeat\fR,
-\fBdcredit\fR,
-\fBucredit\fR,
-\fBlcredit\fR, and
-\fBocredit\fR\&. See the section on the arguments for the details of how
-these work and there defaults\&.
-.RE
-.PP
-Rotated
-.RS 4
-Is the new password a rotated version of the old password?
-.RE
-.PP
-Same consecutive characters
-.RS 4
-Optional check for same consecutive characters\&.
-.RE
-.PP
-Too long monotonic character sequence
-.RS 4
-Optional check for too long monotonic character sequence\&.
-.RE
-.PP
-Contains user name
-.RS 4
-Optional check whether the password contains the user\*(Aqs name in some form\&.
-.RE
-.PP
-These checks are configurable either by use of the module arguments
-or by modifying the \fB/etc/security/pwquality.conf\fR configuration file\&. The
-module arguments override the settings in the configuration file\&.
-.PD
-.SH OPTIONS
-.PP
-\fBdebug\fR
-.RS 4
-This option makes the module write information to
-\fBsyslog\fR(3)
-indicating the behavior of the module (this option does not write password
-information to the log file)\&.
-.RE
-.PP
-\fBauthtok_type=\fR\fB\fIXXX\fR\fR
-.RS 4
-The default action is for the module to use the following prompts when
-requesting passwords: "New UNIX password: " and
-"Retype UNIX password: "\&. The example word
-\fIUNIX\fR
-can be replaced with this option, by default it is empty\&.
-.RE
-.PP
-\fBretry=\fR\fB\fIN\fR\fR
-.RS 4
-Prompt user at most
-\fIN\fR
-times before returning with error\&. The default is
-\fI1\fR\&.
-.RE
-.PP
-\fBdifok=\fR\fB\fIN\fR\fR
-.RS 4
-This argument will change the default of
-\fI1\fR
-for the number of changes in the new password from the old password\&.
-.RE
-.PP
-\fBminlen=\fR\fB\fIN\fR\fR
-.RS 4
-The minimum acceptable size for the new password (plus one if credits are not
-disabled which is the default)\&. In addition to the number of characters in
-the new password, credit (of +1 in length) is given for each different kind
-of character (\fIother\fR,
-\fIupper\fR,
-\fIlower\fR
-and
-\fIdigit\fR)\&. The default for this parameter is
-\fI8\fR
-\&. Note that there is a pair of length limits also in
-\fICracklib\fR,
-which is used for dictionary checking, a "way too short" limit of 4 which
-is hard coded in and a build time defined limit (6) that will be checked
-without reference to \fBminlen\fR\&.
-.RE
-.PP
-\fBdcredit=\fR\fB\fIN\fR\fR
-.RS 4
-(N >= 0) This is the maximum credit for having digits in the new password\&.
-If you have less than or
-\fIN\fR
-digits, each digit will count +1 towards meeting the current
-\fBminlen\fR
-value\&. The default for
-\fBdcredit\fR
-is
-\fI0\fR
-which means there is no bonus for digits in password\&.
-.sp
-(N < 0) This is the minimum number of digits that must be met for a new
-password\&.
-.RE
-.PP
-\fBucredit=\fR\fB\fIN\fR\fR
-.RS 4
-(N >= 0) This is the maximum credit for having upper case letters in the
-new password\&. If you have less than or
-\fIN\fR
-upper case letters each letter will count +1 towards meeting the current
-\fBminlen\fR
-value\&. The default for
-\fBucredit\fR
-is
-\fI0\fR
-which means there is no bonus for upper case letters in password\&.
-.sp
-(N < 0) This is the minimum number of upper case letters that must be met
-for a new password\&.
-.RE
-.PP
-\fBlcredit=\fR\fB\fIN\fR\fR
-.RS 4
-(N >= 0) This is the maximum credit for having lower case letters in the
-new password\&. If you have less than or
-\fIN\fR
-lower case letters, each letter will count +1 towards meeting the current
-\fBminlen\fR
-value\&. The default for
-is
-\fI0\fR
-which means there is no bonus for lower case letters in password\&.
-.sp
-(N < 0) This is the minimum number of lower case letters that must be met
-for a new password\&.
-.RE
-.PP
-\fBocredit=\fR\fB\fIN\fR\fR
-.RS 4
-(N >= 0) This is the maximum credit for having other characters in the new
-password\&. If you have less than or
-\fIN\fR
-other characters, each character will count +1 towards meeting the current
-\fBminlen\fR
-value\&. The default for
-\fBocredit\fR
-is
-\fI0\fR
-which means there is no bonus for other characters in password\&.
-.sp
-(N < 0) This is the minimum number of other characters that must be met for
-a new password\&.
-.RE
-.PP
-\fBminclass=\fR\fB\fIN\fR\fR
-.RS 4
-The minimum number of required classes of characters for the new password\&.
-The default number is zero\&. The four classes are digits, upper and lower
-letters and other characters\&. The difference to the
-\fBcredit\fR
-check is that a specific class if of characters is not required\&. Instead
-\fIN\fR
-out of four of the classes are required\&.
-.RE
-.PP
-\fBmaxrepeat=\fR\fB\fIN\fR\fR
-.RS 4
-Reject passwords which contain more than N same consecutive characters\&.
-The default is 0 which means that this check is disabled\&.
-.RE
-.PP
-\fBmaxsequence=\fR\fB\fIN\fR\fR
-.RS 4
-Reject passwords which contain monotonic character sequences longer than N\&.
-The default is 0 which means that this check is disabled\&.
-Examples of such sequence are \*(Aq12345\*(Aq or \*(Aqfedcb\*(Aq\&. Note that
-most such passwords will not pass the simplicity check unless the sequence
-is only a minor part of the password\&.
-.RE
-.PP
-\fBmaxclassrepeat=\fR\fB\fIN\fR\fR
-.RS 4
-Reject passwords which contain more than N consecutive characters of the
-same class\&.
-The default is 0 which means that this check is disabled\&.
-.RE
-.PP
-\fBgecoscheck=\fR\fB\fIN\fR\fR
-.RS 4
-If nonzero, check whether the individual words longer than 3 characters
-from the
-\fBpasswd GECOS\fR
-field of the user are contained in the new password\&.
-The default is 0 which means that this check is disabled\&.
-.RE
-.PP
-\fBdictcheck=\fR\fB\fIN\fR\fR
-.RS 4
-If nonzero, check whether the password (with possible modifications)
-matches a word in a dictionary\&. Currently the dictionary check is performed
-using the
-\fBcracklib\fR
-library\&.
-The default is 1 which means that this check is enabled\&.
-.RE
-.PP
-\fBbadwords=\fR\fB\fI<list of words>\fR\fR
-.RS 4
-The words more than 3 characters long from this space separated list are
-individually searched for and forbidden in the new password\&.
-By default the list is empty which means that this check is disabled\&.
-.RE
-.PP
-\fBenforce_for_root\fR
-.RS 4
-The module will return error on failed check even if the user changing the
-password is root\&. This option is off by default which means that just
-the message about the failed check is printed but root can change
-the password anyway\&. Note that root is not asked for an old password
-so the checks that compare the old and new password are not performed\&.
-.RE
-.PP
-\fBlocal_users_only\fR
-.RS 4
-The module will not test the password quality for users that are not present
-in the \fI/etc/passwd\fR file\&. The module still asks for the password so
-the following modules in the stack can use the \fBuse_authtok\fR option\&.
-This option is off by default\&.
-.RE
-.PP
-\fBuse_authtok\fR
-.RS 4
-This argument is used to
-\fIforce\fR
-the module to not prompt the user for a new password but use the one
-provided by the previously stacked
-\fIpassword\fR
-module\&.
-.RE
-.PP
-\fBdictpath=\fR\fB\fI/path/to/dict\fR\fR
-.RS 4
-Path to the cracklib dictionaries\&.
-.RE
-
-.PD
-.SH "MODULE TYPES PROVIDED"
-.PP
-Only the
-\fBpassword\fR
-module type is provided\&.
-
-.PD
-.SH "RETURN VALUES"
-.PP
-.PP
-PAM_SUCCESS
-.RS 4
-The new password passes all checks\&.
-.RE
-.PP
-PAM_AUTHTOK_ERR
-.RS 4
-No new password was entered, the username could not be determined or the
-new password fails the strength checks\&.
-.RE
-.PP
-PAM_AUTHTOK_RECOVERY_ERR
-.RS 4
-The old password was not supplied by a previous stacked module or got not
-requested from the user\&. The first error can happen if
-\fBuse_authtok\fR
-is specified\&.
-.RE
-.PP
-PAM_SERVICE_ERR
-.RS 4
-A internal error occurred\&.
-.RE
-.SH "EXAMPLES"
-.PP
-For an example of the use of this module, we show how it may be stacked with the password component of
-\fBpam_unix\fR(8)
-.sp
-.if n \{\
-.RS 4
-.\}
-.nf
-#
-# These lines stack two password type modules\&. In this example the
-# user is given 3 opportunities to enter a strong password\&. The
-# "use_authtok" argument ensures that the pam_unix module does not
-# prompt for a password, but instead uses the one provided by
-# pam_pwquality\&.
-#
-passwd password required pam_pwquality\&.so retry=3
-passwd password required pam_unix\&.so use_authtok
-
-.fi
-.if n \{\
-.RE
-.\}
-.PP
-Another example (in the
-/etc/pam\&.d/passwd
-format) is for the case that you want to use md5 password encryption:
-.sp
-.if n \{\
-.RS 4
-.\}
-.nf
-#%PAM\-1\&.0
-#
-# These lines allow a md5 systems to support passwords of at least 14
-# bytes with extra credit of 2 for digits and 2 for others the new
-# password must have at least three bytes that are not present in the
-# old password
-#
-password required pam_pwquality\&.so \e
- difok=3 minlen=15 dcredit= 2 ocredit=2
-password required pam_unix\&.so use_authtok nullok md5
-
-.fi
-.if n \{\
-.RE
-.\}
-.PP
-And here is another example in case you don\'t want to use credits:
-.sp
-.if n \{\
-.RS 4
-.\}
-.nf
-#%PAM\-1\&.0
-#
-# These lines require the user to select a password with a minimum
-# length of 8 and with at least 1 digit number, 1 upper case letter,
-# and 1 other character
-#
-password required pam_pwquality\&.so \e
- dcredit=\-1 ucredit=\-1 ocredit=\-1 lcredit=0 minlen=8
-password required pam_unix\&.so use_authtok nullok md5
-.fi
-.if n \{\
-.RE
-.\}
-.sp
-.PD
-.SH "SEE ALSO"
-pwscore(1), pwquality.conf(5), pam_pwquality(8),
-pam.conf(5), PAM(8)
-
-.SH AUTHORS
-.nf
-Tomas Mraz <tmraz(a)redhat\&.com>
-Original author of pam_cracklib module Cristian Gafton <gafton(a)redhat\&.com>
-.fi
diff -r b4f44d75bcba -r 306324aced04 doc/man/pam_pwquality.8.pod
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/doc/man/pam_pwquality.8.pod Wed Jul 22 16:41:01 2015 +0200
@@ -0,0 +1,309 @@
+=pod
+
+=head1 NAME
+
+pam_pwquality - PAM module to perform password quality checking
+
+=head1 SYNOPSIS
+
+B<pam_pwquality.so> [I<...>]
+
+=head1 DESCRIPTION
+
+This module can be plugged into the B<password> stack of a given service
+to provide some plug-in strength-checking for passwords.
+The code was originally based on pam_cracklib module and the module is
+backwards compatible with its options.
+
+The action of this module is to prompt the user for a password and check
+its strength against a system dictionary and a set of rules for identifying
+poor choices.
+
+The first action is to prompt for a single password, check its strength
+and then, if it is considered strong, prompt for the password a second time
+(to verify that it was typed correctly on the first occasion). All being
+well, the password is passed on to subsequent modules to be installed as the
+new authentication token.
+
+The checks for strength are:
+
+=over 4
+
+=item Palindrome
+
+Is the new password a palindrome?
+
+=item Case Change Only
+
+Is the new password the the old one with only a change of case?
+
+=item Similar
+
+Is the new password too much like the old one? This is primarily controlled
+by one argument, B<difok> which is a number of character changes (inserts,
+removals, or replacements) between the old and new password that are enough
+to accept the new password.
+
+=item Simple
+
+Is the new password too small? This is controlled by 6 arguments
+B<minlen>, B<maxclassrepeat>, B<dcredit>, B<ucredit>, B<lcredit>,
+and B<ocredit>. See the section on the arguments for the details of how
+these work and there defaults.
+
+=item Rotated
+
+Is the new password a rotated version of the old password?
+
+=item Same consecutive characters
+
+Optional check for same consecutive characters.
+
+=item Too long monotonic character sequence
+
+Optional check for too long monotonic character sequence.
+
+=item Contains user name
+
+Optional check whether the password contains the user's name in some form.
+
+=item Dictionary check
+
+The I<Cracklib> routine is called to check if the password is part of
+a dictionary.
+
+=back
+
+These checks are configurable either by use of the module arguments
+or by modifying the F</etc/security/pwquality.conf> configuration file. The
+module arguments override the settings in the configuration file.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<debug>
+
+This option makes the module write information to L<syslog(3)>
+indicating the behavior of the module (this option does not write password
+information to the log file).
+
+=item B<authtok_type=>I<XXX>
+
+The default action is for the module to use the following prompts when
+requesting passwords: C<"New UNIX password: "> and
+C<"Retype UNIX password: ">. The example word
+I<UNIX> can be replaced with this option, by default it is empty.
+
+=item B<retry=>I<N>
+
+Prompt user at most I<N> times before returning with error. The default is
+I<1>.
+
+=item B<difok=>I<N>
+
+This argument will change the default of I<1> for the number of changes in
+the new password from the old password.
+
+=item B<minlen=>I<N>
+
+The minimum acceptable size for the new password (plus one if credits are not
+disabled which is the default). In addition to the number of characters in
+the new password, credit (of +1 in length) is given for each different kind
+of character (I<other>, I<upper>, I<lower> and I<digit>). The default for this
+parameter is I<8>. Note that there is a pair of length limits also in
+I<Cracklib>, which is used for dictionary checking, a "way too short" limit
+of I<4> which is hard coded in and a build time defined limit (I<6>) that will
+be checked without reference to B<minlen>.
+
+=item B<dcredit=>I<N>
+
+(N >= 0) This is the maximum credit for having digits in the new password.
+If you have less than or I<N> digits, each digit will count +1 towards meeting
+the current B<minlen> value. The default for B<dcredit> is I<0>
+which means there is no bonus for digits in password.
+
+(N < 0) This is the minimum number of digits that must be met for a new
+password.
+
+=item B<ucredit=>I<N>
+
+(N >= 0) This is the maximum credit for having upper case letters in the new password.
+If you have less than or I<N> upper case letters, each upper case letter will count +1 towards meeting
+the current B<minlen> value. The default for B<ucredit> is I<0>
+which means there is no bonus for upper case letters in password.
+
+(N < 0) This is the minimum number of upper case letters that must be met for a new
+password.
+
+=item B<lcredit=>I<N>
+
+(N >= 0) This is the maximum credit for having lower case letters in the new password.
+If you have less than or I<N> lower case letters, each lower case letter will count +1 towards meeting
+the current B<minlen> value. The default for B<lcredit> is I<0>
+which means there is no bonus for lower case letters in password.
+
+(N < 0) This is the minimum number of lower case letters that must be met for a new
+password.
+
+=item B<ocredit=>I<N>
+
+(N >= 0) This is the maximum credit for having other characters in the new password.
+If you have less than or I<N> other characters, each other character will count +1 towards meeting
+the current B<minlen> value. The default for B<ocredit> is I<0>
+which means there is no bonus for other characters in password.
+
+(N < 0) This is the minimum number of other characters that must be met for a new
+password.
+
+=item B<minclass=>I<N>
+
+The minimum number of required classes of characters for the new password.
+The four classes are digits, upper and lower letters and other characters.
+The difference to the B<credit> check is that a specific class if of
+characters is not required. Instead I<N> out of four of the classes are
+required. By default the check is disabled.
+
+=item B<maxrepeat=>I<N>
+
+Reject passwords which contain more than I<N> same consecutive characters.
+The default is 0 which means that this check is disabled.
+
+=item B<maxsequence=>I<N>
+
+Reject passwords which contain monotonic character sequences longer than I<N>.
+The default is 0 which means that this check is disabled.
+Examples of such sequence are '12345' or 'fedcb'. Note that
+most such passwords will not pass the simplicity check unless the sequence
+is only a minor part of the password.
+
+=item B<maxclassrepeat=>I<N>
+
+Reject passwords which contain more than I<N> consecutive characters of the
+same class. The default is 0 which means that this check is disabled.
+
+=item B<gecoscheck=>I<N>
+
+If nonzero, check whether the individual words longer than 3 characters
+from the L<passwd(5)> GECOS field of the user are contained in the new
+password. The default is 0 which means that this check is disabled.
+
+=item B<dictcheck=>I<N>
+
+If nonzero, check whether the password (with possible modifications)
+matches a word in a dictionary. Currently the dictionary check is performed
+using the I<cracklib> library. The default is 1 which means that this check
+is enabled.
+
+=item B<badwords=>I<< <list of words> >>
+
+The words more than 3 characters long from this space separated list are
+individually searched for and forbidden in the new password.
+By default the list is empty which means that this check is disabled.
+
+=item B<dictpath=>I</path/to/dict>
+
+This options allows for specification of non-default path to the cracklib
+dictionaries.
+
+=item B<enforce_for_root>
+
+The module will return error on failed check even if the user changing the
+password is root. This option is off by default which means that just
+the message about the failed check is printed but root can change
+the password anyway. Note that root is not asked for an old password
+so the checks that compare the old and new password are not performed.
+
+=item B<local_users_only>
+
+The module will not test the password quality for users that are not present
+in the F</etc/passwd> file. The module still asks for the password so
+the following modules in the stack can use the B<use_authtok> option.
+This option is off by default.
+
+=item B<use_authtok>
+
+This argument is used to I<force> the module to not prompt the user for
+a new password but use the one provided by the previously stacked
+B<password> module.
+
+=back
+
+=head1 MODULE TYPES PROVIDED
+
+Only the B<password> module type is provided.
+
+=head1 RETURN VALUES
+
+=over 4
+
+=item PAM_SUCCESS
+
+The new password passes all checks.
+
+=item PAM_AUTHTOK_ERR
+
+No new password was entered, the username could not be determined or the
+new password fails the strength checks.
+
+=item PAM_AUTHTOK_RECOVERY_ERR
+
+The old password was not supplied by a previous stacked module or got not
+requested from the user. The first error can happen if B<use_authtok>
+is specified.
+
+=item PAM_SERVICE_ERR
+
+A internal error occurred.
+
+=back
+
+=head1 EXAMPLES
+
+For an example of the use of this module, we show how it may be stacked
+with the password component of L<pam_unix(8)>.
+
+ #
+ # These lines stack two password type modules. In this example the
+ # user is given 3 opportunities to enter a strong password. The
+ # "use_authtok" argument ensures that the pam_unix module does not
+ # prompt for a password, but instead uses the one provided by
+ # pam_pwquality.
+ #
+ password required pam_pwquality.so retry=3
+ password required pam_unix.so use_authtok
+
+Another example is for the case that you want to use sha256 password
+encryption:
+
+ #
+ # These lines allow modern systems to support passwords of at least 14
+ # bytes with extra credit of 2 for digits and 2 for others the new
+ # password must have at least three bytes that are not present in the
+ # old password
+ #
+ password required pam_pwquality.so \
+ difok=3 minlen=15 dcredit=2 ocredit=2
+ password required pam_unix.so use_authtok nullok sha256
+
+And here is another example in case you don't want to use credits:
+
+ #
+ # These lines require the user to select a password with a minimum
+ # length of 8 and with at least 1 digit number, 1 upper case letter,
+ # and 1 other character
+ #
+ password required pam_pwquality.so \
+ dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8
+ password required pam_unix.so use_authtok nullok sha256
+
+=head1 SEE ALSO
+
+L<pwscore(1)>, L<pwquality.conf(5)>, L<pam_pwquality(8)>,
+L<pam.conf(5)>, L<PAM(8)>
+
+=head1 AUTHORS
+
+Tomas Mraz <tmraz(a)redhat.com>
+
+Original author of B<pam_cracklib> module Cristian Gafton <gafton(a)redhat.com>
diff -r b4f44d75bcba -r 306324aced04 doc/man/pwmake.1
--- a/doc/man/pwmake.1 Fri Jul 17 17:08:43 2015 +0200
+++ /dev/null Thu Jan 01 00:00:00 1970 +0000
@@ -1,45 +0,0 @@
-.de FN
-\fI\|\\$1\|\fP
-..
-.TH PWMAKE 1 "10 Nov 2011" "Red Hat, Inc."
-.SH NAME
-pwmake \- simple tool for generating random relatively easily pronounceable
-passwords
-.SH SYNOPSIS
-\fBpwmake\fR <entropy-bits>
-.SH DESCRIPTION
-\fBpwmake\fR is a simple configurable tool for generating random and relatively
-easily pronounceable passwords. The tool allows you to specify the number of
-entropy bits that are used to generate the password.
-
-The entropy is pulled from \fB/dev/urandom\fR.
-
-The minimum number of bits is \fB56\fR which is usable for passwords on
-systems/services where brute force attacks are of very limited rate of tries.
-The \fB64\fR bits should be adequate for applications where the attacker
-does not have direct access to the password hash file. For situations where
-the attacker might obtain the direct access to the password hash or the
-password is used as an encryption key \fB80\fR to \fB128\fR bits should be
-used depending on your level of paranoia.
-
-.PD
-.SH OPTIONS
-The first and only argument is the number of bits of entropy used to generate
-the password.
-
-.SH FILES
-\fB/etc/security/pwquality.conf\fR - The configuration file for the libpwquality
-library.
-
-.PD
-.SH "RETURN CODES"
-\fBpwmake\fR returns 0 on success, non zero on error.
-
-.PD
-.SH "SEE ALSO"
-pwscore(1), pam_pwquality(8)
-
-.SH AUTHORS
-.nf
-Tomas Mraz <tmraz(a)redhat.com>
-.fi
diff -r b4f44d75bcba -r 306324aced04 doc/man/pwmake.1.pod
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/doc/man/pwmake.1.pod Wed Jul 22 16:41:01 2015 +0200
@@ -0,0 +1,48 @@
+=pod
+
+=head1 NAME
+
+B<pwmake> - simple tool for generating random relatively easily pronounceable
+passwords
+
+=head1 SYNOPSIS
+
+B<pwmake> I<< <entropy-bits> >>
+
+=head1 DESCRIPTION
+
+B<pwmake> is a simple configurable tool for generating random and relatively
+easily pronounceable passwords. The tool allows you to specify the number of
+entropy bits that are used to generate the password.
+
+The entropy is pulled from F</dev/urandom>.
+
+The minimum number of bits is I<56> which is usable for passwords on
+systems/services where brute force attacks are of very limited rate of tries.
+The I<64> bits should be adequate for applications where the attacker
+does not have direct access to the password hash file. For situations where
+the attacker might obtain the direct access to the password hash or the
+password is used as an encryption key I<80> to I<128> bits should be
+used depending on your level of paranoia.
+
+=head1 OPTIONS
+
+The first and only argument is the number of bits of entropy used to generate
+the password.
+
+=head1 FILES
+
+F</etc/security/pwquality.conf> - The configuration file for the libpwquality
+library.
+
+=head1 RETURN CODES
+
+B<pwmake> returns 0 on success, non zero on error.
+
+=head1 SEE ALSO
+
+L<pwscore(1)>, L<pam_pwquality(8)>
+
+=head1 AUTHORS
+
+Tomas Mraz <tmraz(a)redhat.com>
diff -r b4f44d75bcba -r 306324aced04 doc/man/pwquality.conf.5
--- a/doc/man/pwquality.conf.5 Fri Jul 17 17:08:43 2015 +0200
+++ /dev/null Thu Jan 01 00:00:00 1970 +0000
@@ -1,133 +0,0 @@
-.\" Escape single quotes in literal strings from groff's Unicode transform.
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.de FN
-\fI\|\\$1\|\fP
-..
-.TH PWQUALITY.CONF 5 "16 Jul 2015" "Red Hat, Inc."
-.SH NAME
-pwquality.conf \- configuration for the libpwquality library
-.SH SYNOPSIS
-\fB/etc/security/pwquality.conf\fR
-\fB/etc/security/pwquality.conf.d/*.conf\fR
-.SH DESCRIPTION
-\fBpwquality.conf\fR provides a way to configure the default password
-quality requirements for the system passwords. This file is read by the
-libpwquality library and utilities that use this library for checking
-and generating passwords.
-
-The file has a very simple \fIname = value\fR format with possible comments
-starting with \fB#\fR character. The whitespace at the beginning of line, end
-of line, and around the \fB=\fR sign is ignored.
-
-The libpwquality library also first reads all \fB*.conf\fR files from the
-\fB/etc/security/pwquality.conf.d\fR directory in ASCII sorted order. The
-values of the same settings are overriden in the order the files are parsed.
-.PD
-.SH OPTIONS
-The possible options in the file are:
-.RS 4
-.PP
-\fBdifok\fR
-.RS 4
-Number of characters in the new password that must not be present in the
-old password. (default 1)
-.RE
-.PP
-\fBminlen\fR
-.RS 4
-Minimum acceptable size for the new password (plus one if credits are not
-disabled which is the default). (See \fIpam_pwquality(8)\fR.)
-Cannot be set to lower value than 6. (default 8)
-.RE
-.PP
-\fBdcredit\fR
-.RS 4
-The maximum credit for having digits in the new password. If less than 0
-it is the minimum number of digits in the new password. (default 0)
-.RE
-.PP
-\fBucredit\fR
-.RS 4
-The maximum credit for having uppercase characters in the new password.
-If less than 0 it is the minimum number of uppercase characters in the new
-password. (default 0)
-.RE
-.PP
-\fBlcredit\fR
-.RS 4
-The maximum credit for having lowercase characters in the new password.
-If less than 0 it is the minimum number of lowercase characters in the new
-password. (default 0)
-.RE
-.PP
-\fBocredit\fR
-.RS 4
-The maximum credit for having other characters in the new password.
-If less than 0 it is the minimum number of other characters in the new
-password. (default 0)
-.RE
-.PP
-\fBminclass\fR
-.RS 4
-The minimum number of required classes of characters for the new
-password (digits, uppercase, lowercase, others). (default 0)
-.RE
-.PP
-\fBmaxrepeat\fR
-.RS 4
-The maximum number of allowed same consecutive characters in the new password.
-The check is disabled if the value is 0. (default 0)
-.RE
-.PP
-\fBmaxsequence\fR
-.RS 4
-The maximum length of monotonic character sequences in the new password.
-Examples of such sequence are \*(Aq12345\*(Aq or \*(Aqfedcb\*(Aq\&. Note
-that most such passwords will not pass the simplicity check unless
-the sequence is only a minor part of the password.
-The check is disabled if the value is 0. (default 0)
-.RE
-.PP
-\fBmaxclassrepeat\fR
-.RS 4
-The maximum number of allowed consecutive characters of the same class in the
-new password.
-The check is disabled if the value is 0. (default 0)
-.RE
-.PP
-\fBgecoscheck\fR
-.RS 4
-If nonzero, check whether the words longer than 3 characters from the GECOS
-field of the user's passwd entry are contained in the new password.
-The check is disabled if the value is 0. (default 0)
-.RE
-.PP
-\fBdictcheck\fR
-.RS 4
-If nonzero, check whether the password (with possible modifications)
-matches a word in a dictionary. Currently the dictionary check is performed
-using the cracklib library. (default 1)
-.RE
-.PP
-\fBbadwords\fR
-.RS 4
-Space separated list of words that must not be contained in the password. These
-are additional words to the cracklib dictionary check. This setting can be
-also used by applications to emulate the gecos check for user accounts that are
-not created yet.
-.RE
-.PP
-\fBdictpath\fR
-.RS 4
-Path to the cracklib dictionaries. Default is to use the cracklib default.
-.RE
-
-.PD
-.SH "SEE ALSO"
-pwscore(1), pwmake(1), pam_pwquality(8)
-
-.SH AUTHORS
-.nf
-Tomas Mraz <tmraz(a)redhat.com>
-.fi
diff -r b4f44d75bcba -r 306324aced04 doc/man/pwquality.conf.5.pod
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/doc/man/pwquality.conf.5.pod Wed Jul 22 16:41:01 2015 +0200
@@ -0,0 +1,123 @@
+=pod
+
+=head1 NAME
+
+pwquality.conf - configuration for the libpwquality library
+
+=head1 SYNOPSIS
+
+F</etc/security/pwquality.conf>
+
+F</etc/security/pwquality.conf.d/*.conf>
+
+=head1 DESCRIPTION
+
+B<pwquality.conf> provides a way to configure the default password
+quality requirements for the system passwords. This file is read by the
+libpwquality library and utilities that use this library for checking
+and generating passwords.
+
+The file has a very simple I<name = value> format with possible comments
+starting with C<#> character. The whitespace at the beginning of line, end
+of line, and around the C<=> sign is ignored.
+
+The libpwquality library also first reads all F<*.conf> files from the
+F</etc/security/pwquality.conf.d> directory in ASCII sorted order. The
+values of the same settings are overriden in the order the files are parsed.
+
+=head1 OPTIONS
+
+The possible options in the file are:
+
+=over 4
+
+=item B<difok>
+
+Number of characters in the new password that must not be present in the
+old password. (default 1)
+
+=item B<minlen>
+
+Minimum acceptable size for the new password (plus one if credits are not
+disabled which is the default). (See L<pam_pwquality(8)>.)
+Cannot be set to lower value than 6. (default 8)
+
+=item B<dcredit>
+
+The maximum credit for having digits in the new password. If less than 0
+it is the minimum number of digits in the new password. (default 0)
+
+=item B<ucredit>
+
+The maximum credit for having uppercase characters in the new password.
+If less than 0 it is the minimum number of uppercase characters in the new
+password. (default 0)
+
+=item B<lcredit>
+
+The maximum credit for having lowercase characters in the new password.
+If less than 0 it is the minimum number of lowercase characters in the new
+password. (default 0)
+
+=item B<ocredit>
+
+The maximum credit for having other characters in the new password.
+If less than 0 it is the minimum number of other characters in the new
+password. (default 0)
+
+=item B<minclass>
+
+The minimum number of required classes of characters for the new
+password (digits, uppercase, lowercase, others). (default 0)
+
+=item B<maxrepeat>
+
+The maximum number of allowed same consecutive characters in the new password.
+The check is disabled if the value is 0. (default 0)
+
+=item B<maxsequence>
+
+The maximum length of monotonic character sequences in the new password.
+Examples of such sequence are '12345' or 'fedcb'. Note
+that most such passwords will not pass the simplicity check unless
+the sequence is only a minor part of the password.
+The check is disabled if the value is 0. (default 0)
+
+=item B<maxclassrepeat>
+
+The maximum number of allowed consecutive characters of the same class in the
+new password.
+The check is disabled if the value is 0. (default 0)
+
+=item B<gecoscheck>
+
+If nonzero, check whether the words longer than 3 characters from the I<GECOS>
+field of the user's L<passwd(5)> entry are contained in the new password.
+The check is disabled if the value is 0. (default 0)
+
+=item B<dictcheck>
+
+If nonzero, check whether the password (with possible modifications)
+matches a word in a dictionary. Currently the dictionary check is performed
+using the cracklib library. (default 1)
+
+=item B<badwords>
+
+Space separated list of words that must not be contained in the password. These
+are additional words to the cracklib dictionary check. This setting can be
+also used by applications to emulate the gecos check for user accounts that are
+not created yet.
+
+=item B<dictpath>
+
+Path to the cracklib dictionaries. Default is to use the cracklib default.
+
+=back
+
+=head1 SEE ALSO
+
+L<pwscore(1)>, L<pwmake(1)>, L<pam_pwquality(8)>
+
+=head1 AUTHORS
+
+Tomas Mraz <tmraz(a)redhat.com>
diff -r b4f44d75bcba -r 306324aced04 doc/man/pwscore.1
--- a/doc/man/pwscore.1 Fri Jul 17 17:08:43 2015 +0200
+++ /dev/null Thu Jan 01 00:00:00 1970 +0000
@@ -1,48 +0,0 @@
-.de FN
-\fI\|\\$1\|\fP
-..
-.TH PWSCORE 1 "10 Nov 2011" "Red Hat, Inc."
-.SH NAME
-pwscore \- simple configurable tool for checking quality of a password
-.SH SYNOPSIS
-\fBpwscore\fR [user]
-.SH DESCRIPTION
-\fBpwscore\fR is a simple tool for checking quality of a password. The password
-is read from stdin.
-
-The tool uses the \fBlibpwquality\fR library to perform configurable checks
-for minimum length, dictionary checking against cracklib dictionaries,
-and other checks.
-
-It either reports an error if the password fails any of the checks, or it
-prints out the password quality score as an integer value between \fB0\fR and
-\fB100\fR.
-
-The password quality score is relative to the \fBminlen\fR setting in the
-configuration file. But in general values below 50 can be treated as moderate
-quality and above it fairly strong quality. Any password that passes the quality
-checks (especially the mandatory cracklib check) should withstand dictionary
-attacks and scores above 50 with the default minlen setting even fast brute
-force attacks.
-
-.PD
-.SH OPTIONS
-The first and only optional argument is the user name that is used to check
-the similarity of the password to the username.
-
-.SH FILES
-\fB/etc/security/pwquality.conf\fR - The configuration file for the libpwquality
-library.
-
-.PD
-.SH "RETURN CODES"
-\fBpwscore\fR returns 0 on success, non zero on error.
-
-.PD
-.SH "SEE ALSO"
-pwscore(1), pwquality.conf(5), pam_pwquality(8)
-
-.SH AUTHORS
-.nf
-Tomas Mraz <tmraz(a)redhat.com>
-.fi
diff -r b4f44d75bcba -r 306324aced04 doc/man/pwscore.1.pod
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/doc/man/pwscore.1.pod Wed Jul 22 16:41:01 2015 +0200
@@ -0,0 +1,51 @@
+=pod
+
+=head1 NAME
+
+pwscore - simple configurable tool for checking quality of a password
+
+=head1 SYNOPSIS
+
+B<pwscore> [I<user>]
+
+=head1 DESCRIPTION
+
+B<pwscore> is a simple tool for checking quality of a password. The password
+is read from stdin.
+
+The tool uses the B<libpwquality> library to perform configurable checks
+for minimum length, dictionary checking against cracklib dictionaries,
+and other checks.
+
+It either reports an error if the password fails any of the checks, or it
+prints out the password quality score as an integer value between I<0> and
+I<100>.
+
+The password quality score is relative to the B<minlen> setting in the
+configuration file. But in general values below 50 can be treated as moderate
+quality and above it fairly strong quality. Any password that passes the quality
+checks (especially the mandatory cracklib check) should withstand dictionary
+attacks and scores above 50 with the default minlen setting even fast brute
+force attacks.
+
+=head1 OPTIONS
+
+The first and only optional argument is the user name that is used to check
+the similarity of the password to the username.
+
+=head1 FILES
+
+F</etc/security/pwquality.conf> - The configuration file for the libpwquality
+library.
+
+=head1 RETURN CODES
+
+B<pwscore> returns 0 on success, non zero on error.
+
+=head1 SEE ALSO
+
+L<pwscore(1)>, L<pwquality.conf(5)>, L<pam_pwquality(8)>
+
+=head1 AUTHORS
+
+Tomas Mraz <tmraz(a)redhat.com>