changeset 79ca3b91513f in /srv/hg/libpwquality
details: http://hg.fedorahosted.org/hg/srv/hg/libpwquality?cmd=changeset;node=79ca3b…
summary: Add an 'enforcing' setting to make the checks to be warning-only in PAM.
diffstat:
doc/man/pam_pwquality.8.pod | 6 ++++++
doc/man/pwquality.conf.5.pod | 7 +++++++
src/pam_pwquality.c | 6 ++++--
src/pwqprivate.h | 2 ++
src/pwquality.conf | 5 +++++
src/pwquality.h | 1 +
src/settings.c | 8 ++++++++
7 files changed, 33 insertions(+), 2 deletions(-)
diffs (137 lines):
diff -r 842f68d0e021 -r 79ca3b91513f doc/man/pam_pwquality.8.pod
--- a/doc/man/pam_pwquality.8.pod Mon Oct 31 10:36:07 2016 +0100
+++ b/doc/man/pam_pwquality.8.pod Tue Nov 01 15:16:54 2016 +0100
@@ -202,6 +202,12 @@
this check is enabled. It is not performed for user names shorter
than 3 characters.
+=item B<enforcing=>I<N>
+
+If nonzero, reject the password if it fails the checks, otherwise
+only print the warning. The default is 1 which means that the weak password
+is rejected (for non-root users).
+
=item B<badwords=>I<< <list of words> >>
The words more than 3 characters long from this space separated list are
diff -r 842f68d0e021 -r 79ca3b91513f doc/man/pwquality.conf.5.pod
--- a/doc/man/pwquality.conf.5.pod Mon Oct 31 10:36:07 2016 +0100
+++ b/doc/man/pwquality.conf.5.pod Tue Nov 01 15:16:54 2016 +0100
@@ -107,6 +107,13 @@
contains the user name in some form. It is not performed for user names shorter
than 3 characters. (default 1)
+=item B<enforcing=>I<N>
+
+If nonzero, reject the password if it fails the checks, otherwise
+only print the warning. This setting applies only to the pam_pwquality module
+and possibly other applications that explicitly change their behavior
+based on it. It does not affect L<pwmake(1)> and L<pwscore(1)>. (default 1)
+
=item B<badwords>
Space separated list of words that must not be contained in the password. These
diff -r 842f68d0e021 -r 79ca3b91513f src/pam_pwquality.c
--- a/src/pam_pwquality.c Mon Oct 31 10:36:07 2016 +0100
+++ b/src/pam_pwquality.c Tue Nov 01 15:16:54 2016 +0100
@@ -235,13 +235,15 @@
if (retval < 0) {
const char *msg;
char buf[PWQ_MAX_ERROR_MESSAGE_LEN];
+ int enforcing = 1;
msg = pwquality_strerror(buf, sizeof(buf), retval, auxerror);
if (ctrl & PAM_DEBUG_ARG)
pam_syslog(pamh, LOG_DEBUG, "bad password: %s", msg);
pam_error(pamh, _("BAD PASSWORD: %s"), msg);
+ pwquality_get_int_value(options.pwq, PWQ_SETTING_ENFORCING, &enforcing);
- if (getuid() || options.enforce_for_root ||
- (flags & PAM_CHANGE_EXPIRED_AUTHTOK)) {
+ if (enforcing && (getuid() || options.enforce_for_root ||
+ (flags & PAM_CHANGE_EXPIRED_AUTHTOK))) {
pam_set_item(pamh, PAM_AUTHTOK, NULL);
retval = PAM_AUTHTOK_ERR;
continue;
diff -r 842f68d0e021 -r 79ca3b91513f src/pwqprivate.h
--- a/src/pwqprivate.h Mon Oct 31 10:36:07 2016 +0100
+++ b/src/pwqprivate.h Tue Nov 01 15:16:54 2016 +0100
@@ -26,6 +26,7 @@
int gecos_check;
int dict_check;
int user_check;
+ int enforcing;
char *bad_words;
char *dict_path;
};
@@ -44,6 +45,7 @@
#define PWQ_DEFAULT_OTH_CREDIT 0
#define PWQ_DEFAULT_DICT_CHECK 1
#define PWQ_DEFAULT_USER_CHECK 1
+#define PWQ_DEFAULT_ENFORCING 1
#define PWQ_TYPE_INT 1
#define PWQ_TYPE_STR 2
diff -r 842f68d0e021 -r 79ca3b91513f src/pwquality.conf
--- a/src/pwquality.conf Mon Oct 31 10:36:07 2016 +0100
+++ b/src/pwquality.conf Tue Nov 01 15:16:54 2016 +0100
@@ -54,5 +54,10 @@
# The check is enabled if the value is not 0.
# usercheck = 1
#
+# Whether the check is enforced by the PAM module and possibly other
+# applications.
+# The new password is rejected if it fails the check and the value is not 0.
+# enforcing = 1
+#
# Path to the cracklib dictionaries. Default is to use the cracklib default.
# dictpath =
diff -r 842f68d0e021 -r 79ca3b91513f src/pwquality.h
--- a/src/pwquality.h Mon Oct 31 10:36:07 2016 +0100
+++ b/src/pwquality.h Tue Nov 01 15:16:54 2016 +0100
@@ -29,6 +29,7 @@
#define PWQ_SETTING_MAX_SEQUENCE 14
#define PWQ_SETTING_DICT_CHECK 15
#define PWQ_SETTING_USER_CHECK 16
+#define PWQ_SETTING_ENFORCING 17
#define PWQ_MAX_ENTROPY_BITS 256
#define PWQ_MIN_ENTROPY_BITS 56
diff -r 842f68d0e021 -r 79ca3b91513f src/settings.c
--- a/src/settings.c Mon Oct 31 10:36:07 2016 +0100
+++ b/src/settings.c Tue Nov 01 15:16:54 2016 +0100
@@ -35,6 +35,7 @@
pwq->oth_credit = PWQ_DEFAULT_OTH_CREDIT;
pwq->dict_check = PWQ_DEFAULT_DICT_CHECK;
pwq->user_check = PWQ_DEFAULT_USER_CHECK;
+ pwq->enforcing = PWQ_DEFAULT_ENFORCING;
return pwq;
}
@@ -64,6 +65,7 @@
{ "gecoscheck", PWQ_SETTING_GECOS_CHECK, PWQ_TYPE_INT},
{ "dictcheck", PWQ_SETTING_DICT_CHECK, PWQ_TYPE_INT},
{ "usercheck", PWQ_SETTING_USER_CHECK, PWQ_TYPE_INT},
+ { "enforcing", PWQ_SETTING_ENFORCING, PWQ_TYPE_INT},
{ "badwords", PWQ_SETTING_BAD_WORDS, PWQ_TYPE_STR},
{ "dictpath", PWQ_SETTING_DICT_PATH, PWQ_TYPE_STR}
};
@@ -338,6 +340,9 @@
case PWQ_SETTING_USER_CHECK:
pwq->user_check = value;
break;
+ case PWQ_SETTING_ENFORCING:
+ pwq->enforcing = value;
+ break;
default:
return PWQ_ERROR_NON_INT_SETTING;
}
@@ -421,6 +426,9 @@
case PWQ_SETTING_USER_CHECK:
*value = pwq->user_check;
break;
+ case PWQ_SETTING_ENFORCING:
+ *value = pwq->enforcing;
+ break;
default:
return PWQ_ERROR_NON_INT_SETTING;
}
changeset 842f68d0e021 in /srv/hg/libpwquality
details: http://hg.fedorahosted.org/hg/srv/hg/libpwquality?cmd=changeset;node=842f68…
summary: Make the user check optional.
diffstat:
doc/man/pam_pwquality.8.pod | 7 +++++++
doc/man/pwquality.conf.5.pod | 6 ++++++
src/check.c | 3 ++-
src/pwqprivate.h | 2 ++
src/pwquality.conf | 8 ++++++++
src/pwquality.h | 1 +
src/settings.c | 8 ++++++++
7 files changed, 34 insertions(+), 1 deletions(-)
diffs (132 lines):
diff -r d637572f3d34 -r 842f68d0e021 doc/man/pam_pwquality.8.pod
--- a/doc/man/pam_pwquality.8.pod Mon Oct 31 10:03:35 2016 +0100
+++ b/doc/man/pam_pwquality.8.pod Mon Oct 31 10:36:07 2016 +0100
@@ -195,6 +195,13 @@
using the I<cracklib> library. The default is 1 which means that this check
is enabled.
+=item B<usercheck=>I<N>
+
+If nonzero, check whether the password (with possible modifications)
+contains the user name in some form. The default is 1 which means that
+this check is enabled. It is not performed for user names shorter
+than 3 characters.
+
=item B<badwords=>I<< <list of words> >>
The words more than 3 characters long from this space separated list are
diff -r d637572f3d34 -r 842f68d0e021 doc/man/pwquality.conf.5.pod
--- a/doc/man/pwquality.conf.5.pod Mon Oct 31 10:03:35 2016 +0100
+++ b/doc/man/pwquality.conf.5.pod Mon Oct 31 10:36:07 2016 +0100
@@ -101,6 +101,12 @@
matches a word in a dictionary. Currently the dictionary check is performed
using the cracklib library. (default 1)
+=item B<usercheck=>I<N>
+
+If nonzero, check whether the password (with possible modifications)
+contains the user name in some form. It is not performed for user names shorter
+than 3 characters. (default 1)
+
=item B<badwords>
Space separated list of words that must not be contained in the password. These
diff -r d637572f3d34 -r 842f68d0e021 src/check.c
--- a/src/check.c Mon Oct 31 10:03:35 2016 +0100
+++ b/src/check.c Mon Oct 31 10:36:07 2016 +0100
@@ -560,7 +560,8 @@
if (!rv && sequence(pwq, new, auxerror))
rv = PWQ_ERROR_MAX_SEQUENCE;
- if (!rv && usermono && usercheck(pwq, newmono, usermono))
+ if (!rv && usermono && pwq->user_check &&
+ usercheck(pwq, newmono, usermono))
rv = PWQ_ERROR_USER_CHECK;
if (!rv && user && pwq->gecos_check)
diff -r d637572f3d34 -r 842f68d0e021 src/pwqprivate.h
--- a/src/pwqprivate.h Mon Oct 31 10:03:35 2016 +0100
+++ b/src/pwqprivate.h Mon Oct 31 10:36:07 2016 +0100
@@ -25,6 +25,7 @@
int max_sequence;
int gecos_check;
int dict_check;
+ int user_check;
char *bad_words;
char *dict_path;
};
@@ -42,6 +43,7 @@
#define PWQ_DEFAULT_LOW_CREDIT 0
#define PWQ_DEFAULT_OTH_CREDIT 0
#define PWQ_DEFAULT_DICT_CHECK 1
+#define PWQ_DEFAULT_USER_CHECK 1
#define PWQ_TYPE_INT 1
#define PWQ_TYPE_STR 2
diff -r d637572f3d34 -r 842f68d0e021 src/pwquality.conf
--- a/src/pwquality.conf Mon Oct 31 10:03:35 2016 +0100
+++ b/src/pwquality.conf Mon Oct 31 10:36:07 2016 +0100
@@ -46,5 +46,13 @@
# The check is enabled if the value is not 0.
# gecoscheck = 0
#
+# Whether to check for the words from the cracklib dictionary.
+# The check is enabled if the value is not 0.
+# dictcheck = 1
+#
+# Whether to check if it contains the user name in some form.
+# The check is enabled if the value is not 0.
+# usercheck = 1
+#
# Path to the cracklib dictionaries. Default is to use the cracklib default.
# dictpath =
diff -r d637572f3d34 -r 842f68d0e021 src/pwquality.h
--- a/src/pwquality.h Mon Oct 31 10:03:35 2016 +0100
+++ b/src/pwquality.h Mon Oct 31 10:36:07 2016 +0100
@@ -28,6 +28,7 @@
#define PWQ_SETTING_BAD_WORDS 13
#define PWQ_SETTING_MAX_SEQUENCE 14
#define PWQ_SETTING_DICT_CHECK 15
+#define PWQ_SETTING_USER_CHECK 16
#define PWQ_MAX_ENTROPY_BITS 256
#define PWQ_MIN_ENTROPY_BITS 56
diff -r d637572f3d34 -r 842f68d0e021 src/settings.c
--- a/src/settings.c Mon Oct 31 10:03:35 2016 +0100
+++ b/src/settings.c Mon Oct 31 10:36:07 2016 +0100
@@ -34,6 +34,7 @@
pwq->low_credit = PWQ_DEFAULT_LOW_CREDIT;
pwq->oth_credit = PWQ_DEFAULT_OTH_CREDIT;
pwq->dict_check = PWQ_DEFAULT_DICT_CHECK;
+ pwq->user_check = PWQ_DEFAULT_USER_CHECK;
return pwq;
}
@@ -62,6 +63,7 @@
{ "maxsequence", PWQ_SETTING_MAX_SEQUENCE, PWQ_TYPE_INT},
{ "gecoscheck", PWQ_SETTING_GECOS_CHECK, PWQ_TYPE_INT},
{ "dictcheck", PWQ_SETTING_DICT_CHECK, PWQ_TYPE_INT},
+ { "usercheck", PWQ_SETTING_USER_CHECK, PWQ_TYPE_INT},
{ "badwords", PWQ_SETTING_BAD_WORDS, PWQ_TYPE_STR},
{ "dictpath", PWQ_SETTING_DICT_PATH, PWQ_TYPE_STR}
};
@@ -333,6 +335,9 @@
case PWQ_SETTING_DICT_CHECK:
pwq->dict_check = value;
break;
+ case PWQ_SETTING_USER_CHECK:
+ pwq->user_check = value;
+ break;
default:
return PWQ_ERROR_NON_INT_SETTING;
}
@@ -413,6 +418,9 @@
case PWQ_SETTING_DICT_CHECK:
*value = pwq->dict_check;
break;
+ case PWQ_SETTING_USER_CHECK:
+ *value = pwq->user_check;
+ break;
default:
return PWQ_ERROR_NON_INT_SETTING;
}
changeset d637572f3d34 in /srv/hg/libpwquality
details: http://hg.fedorahosted.org/hg/srv/hg/libpwquality?cmd=changeset;node=d63757…
summary: Do not try to check presence of too short username in password.
diffstat:
src/check.c | 11 +++++++++--
1 files changed, 9 insertions(+), 2 deletions(-)
diffs (35 lines):
diff -r 33aa0af8a29b -r d637572f3d34 src/check.c
--- a/src/check.c Thu May 05 09:24:04 2016 +0200
+++ b/src/check.c Mon Oct 31 10:03:35 2016 +0100
@@ -22,6 +22,8 @@
#endif
#define MIN(_a, _b) (((_a) < (_b)) ? (_a) : (_b))
+#define PW_MIN_USERNAME_LEN_TO_CHECK 3
+
/* Helper functions */
/*
@@ -373,7 +375,12 @@
char *user)
{
char *f, *b;
- int dist;
+ int dist, userlen = strlen(user);
+
+ /* No point to check for username in password in 1 or 2-char
+ * usernames; it will be contained one way or another anyway. */
+ if (userlen < PW_MIN_USERNAME_LEN_TO_CHECK)
+ return 0;
if (strstr(new, user) != NULL)
return 1;
@@ -385,7 +392,7 @@
/* now reverse the username, we can do that in place
as it is strdup-ed */
f = user;
- b = user + strlen(user) - 1;
+ b = user + userlen - 1;
while (f < b) {
char c;
changeset 33aa0af8a29b in /srv/hg/libpwquality
details: http://hg.fedorahosted.org/hg/srv/hg/libpwquality?cmd=changeset;node=33aa0a…
summary: The user name check is not optional.
diffstat:
doc/man/pam_pwquality.8.pod | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diffs (12 lines):
diff -r 3447d64e5ab8 -r 33aa0af8a29b doc/man/pam_pwquality.8.pod
--- a/doc/man/pam_pwquality.8.pod Mon Mar 21 08:54:11 2016 +0100
+++ b/doc/man/pam_pwquality.8.pod Thu May 05 09:24:04 2016 +0200
@@ -65,7 +65,7 @@
=item Contains user name
-Optional check whether the password contains the user's name in some form.
+Check whether the password contains the user's name in some form.
=item Dictionary check
changeset a122d10250f0 in /srv/hg/libpwquality
details: http://hg.fedorahosted.org/hg/srv/hg/libpwquality?cmd=changeset;node=a122d1…
summary: Add API manual page.
diffstat:
doc/man/Makefile.am | 9 ++-
doc/man/pwquality.3.pod | 133 ++++++++++++++++++++++++++++++++++++++++++++++++
po/es.po | 53 ++++++++++++------
3 files changed, 174 insertions(+), 21 deletions(-)
diffs (295 lines):
diff -r 306324aced04 -r a122d10250f0 doc/man/Makefile.am
--- a/doc/man/Makefile.am Wed Jul 22 16:41:01 2015 +0200
+++ b/doc/man/Makefile.am Wed Jul 22 18:53:42 2015 +0200
@@ -1,10 +1,10 @@
-dist_man_MANS = pwmake.1 pwscore.1 pwquality.conf.5
+dist_man_MANS = pwmake.1 pwscore.1 pwquality.conf.5 pwquality.3
if HAVE_PAM
dist_man_MANS += pam_pwquality.8
endif
-EXTRA_DIST=pam_pwquality.8.pod pwmake.1.pod pwscore.1.pod pwquality.conf.5.pod
+EXTRA_DIST=pam_pwquality.8.pod pwmake.1.pod pwscore.1.pod pwquality.conf.5.pod pwquality.3.pod
%.8: %.8.pod
bash -c 'declare -u ucname=$*; pod2man --utf8 --name="$$ucname" --section=8 --center="Linux-PAM Manual" --release="Red Hat, Inc." $< $@'
@@ -15,5 +15,8 @@
%.5: %.5.pod
bash -c 'declare -u ucname=$*; pod2man --utf8 --name="$$ucname" --section=5 --center="File Formats Manual" --release="Red Hat, Inc." $< $@'
+%.3: %.3.pod
+ bash -c 'declare -u ucname=$*; pod2man --utf8 --name="$$ucname" --section=5 --center="Libpwquality API Manual" --release="Red Hat, Inc." $< $@'
+
manclean:
- rm *.8 *.1 *.5
+ rm *.8 *.1 *.5 *.3
diff -r 306324aced04 -r a122d10250f0 doc/man/pwquality.3.pod
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/doc/man/pwquality.3.pod Wed Jul 22 18:53:42 2015 +0200
@@ -0,0 +1,133 @@
+=pod
+
+=head1 NAME
+
+pwquality - Documentation of the libpwquality API
+
+=head1 SYNOPSIS
+
+ #include <pwquality.h>
+
+ pwquality_settings_t *pwquality_default_settings(void);
+ void pwquality_free_settings(pwquality_settings_t *pwq);
+
+ int pwquality_read_config(pwquality_settings_t *pwq, const char *cfgfile,
+ void **auxerror);
+
+ int pwquality_set_option(pwquality_settings_t *pwq, const char *option);
+ int pwquality_set_int_value(pwquality_settings_t *pwq, int setting, int value);
+ int pwquality_set_str_value(pwquality_settings_t *pwq, int setting,
+ const char *value);
+ int pwquality_get_int_value(pwquality_settings_t *pwq, int setting, int *value);
+ int pwquality_get_str_value(pwquality_settings_t *pwq, int setting, const char **value);
+
+ int pwquality_generate(pwquality_settings_t *pwq, int entropy_bits,
+ char **password);
+
+ int pwquality_check(pwquality_settings_t *pwq, const char *password,
+ const char *oldpassword, const char *user, void **auxerror);
+
+ const char *pwquality_strerror(char *buf, size_t len, int errcode, void *auxerror);
+
+=head1 DESCRIPTION
+
+Function I<pwquality_default_settings()> allocates and returns default pwquality settings
+to be used in other library calls. The allocated opaque structure has to be freed
+with the I<pwquality_free_settings()> call.
+
+The I<pwquality_read_config()> parses the configuration file (if B<cfgfile> is NULL
+then the default one). If B<auxerror> is not NULL it also possibly returns auxiliary
+error information that must be passed into I<pwquality_strerror()> function.
+
+=over 4
+
+=item B<New in 1.3.0:>
+
+The library first tries to parse all F<*.conf> configuration files from
+F<< <cfgfile>.d >> directory if it exists. Order of parsing determines what values will
+be in effect - the latest wins.
+
+=back
+
+Function I<pwquality_set_option()> is useful for setting the options as configured
+on a pam module command line in form of <opt>=<val>.
+
+Getter and setter functions for the individual integer and string setting values are:
+I<pwquality_set_int_value()>, I<pwquality_set_str_value()>,
+I<pwquality_get_int_value()>, and I<pwquality_get_str_value()>. In case of the
+string getter the caller must copy the string before another calls that can
+manipulate the B<pwq> settings object.
+
+The I<pwquality_generate()> function generates a random password of B<entropy_bits> entropy
+and check it according to the settings. The B<*password> is allocated on heap by the
+library.
+
+The I<pwquality_check()> function checks the B<password> according to the settings. It
+returns either score <0-100>, negative error number, and possibly also auxiliary error
+information that must be passed into I<pwquality_strerror()> function.
+The B<oldpassword> is optional and can be NULL.
+The B<user> is used for checking the B<password> against the user name
+and potentially other L<passwd(5)> information and can be NULL.
+The B<auxerror> can be NULL - in that case the auxiliary error information
+is not returned.
+However if it is non-NULL not passing the returned B<*auxerror> into
+I<pwquality_strerror()> can lead to memory leaks.
+The score depends on value of the setting B<PWQ_SETTING_MIN_LENGTH>. If it is
+set higher, the score for the same passwords will be lower.
+
+Function I<pwquality_strerror()> translates the B<errcode> and B<auxerror> auxiliary
+data into localized text message. If B<buf> is NULL the function uses an internal static
+buffer which makes the function non-reentrant in that case. The returned pointer is not
+guaranteed to point to the B<buf>.
+
+=head1 RETURN VALUES
+
+In general the functions which return B<int> return 0 as success value and negative values
+as concrete B<PWQ_ERROR> error code. I<pwquality_strerror()> does not allocate data
+and so it cannot fail.
+
+The returned positive or zero score from I<pwquality_check()> should not be used for
+rejection of passwords, it should be used only as approximate indicator of entropy present
+in the password with values such as 0-30 being low, 30-60 medium, and 60-100 high.
+
+=head1 EXAMPLE
+
+Typical use of the libpwquality API:
+
+ #include <pwquality.h>
+
+ ...
+
+ pwquality_settings_t *pwq;
+ int rv;
+ void *auxerror;
+ char buf[1024];
+
+ pwq = pwquality_default_settings();
+ if (pwq == NULL) {
+ fprintf(stderr, "Error: %s\n", pwquality_strerror(buf, sizeof(buf), PWQ_ERROR_MEM_ALLOC, NULL));
+ return -1;
+ }
+
+ if ((rv=pwquality_read_config(pwq, NULL, &auxerror)) != 0) {
+ pwquality_free_settings(pwq);
+ fprintf(stderr, "Error: %s\n", pwquality_strerror(buf, sizeof(buf), rv, auxerror));
+ return -1;
+ }
+
+ rv = pwquality_check(pwq, buf, NULL, user, &auxerror);
+ pwquality_free_settings(pwq);
+
+ if (rv >= 0) {
+ fprintf(stderr, "Password entropy score is: %d\n", rv);
+ } else {
+ fprintf(stderr, "Password is rejected with error: %s\n", pwquality_strerror(buf, sizeof(buf), rv, auxerror));
+ }
+
+=head1 SEE ALSO
+
+L<pwquality.conf(5)>
+
+=head1 AUTHORS
+
+Tomas Mraz <tmraz(a)redhat.com>
diff -r 306324aced04 -r a122d10250f0 po/es.po
--- a/po/es.po Wed Jul 22 16:41:01 2015 +0200
+++ b/po/es.po Wed Jul 22 18:53:42 2015 +0200
@@ -1,7 +1,7 @@
# SOME DESCRIPTIVE TITLE.
# Copyright (C) YEAR libpwquality project
# This file is distributed under the same license as the PACKAGE package.
-#
+#
# Translators:
# Adolfo Jayme Barrientos, 2015
# Claudio Rodrigo Pereyra Diaz <elsupergomez(a)gmail.com>, 2011
@@ -16,11 +16,12 @@
"POT-Creation-Date: 2014-08-06 16:45+0200\n"
"PO-Revision-Date: 2015-02-01 00:56+0000\n"
"Last-Translator: Adolfo Jayme Barrientos\n"
-"Language-Team: Spanish (http://www.transifex.com/projects/p/libpwquality/language/es/)\n"
+"Language-Team: Spanish (http://www.transifex.com/projects/p/libpwquality/"
+"language/es/)\n"
+"Language: es\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
-"Language: es\n"
"Plural-Forms: nplurals=2; plural=(n != 1);\n"
#: src/pam_pwquality.c:25
@@ -50,9 +51,10 @@
#: src/pwscore.c:23
#, c-format
msgid ""
-" The command reads the password to be scored from the standard "
-"input.\n"
-msgstr " La orden lee la contraseña que se valorará a partir de la entrada estándar.\n"
+" The command reads the password to be scored from the standard input.\n"
+msgstr ""
+" La orden lee la contraseña que se valorará a partir de la entrada "
+"estándar.\n"
#: src/pwscore.c:51 src/pwscore.c:59 src/pwscore.c:65
#, c-format
@@ -68,7 +70,9 @@
msgid ""
"Password quality check failed:\n"
" %s\n"
-msgstr "Falló la comprobación de calidad de la contraseña:\n %s\n"
+msgstr ""
+"Falló la comprobación de calidad de la contraseña:\n"
+" %s\n"
#: src/pwmake.c:22
#, c-format
@@ -104,9 +108,10 @@
msgstr "De alguna manera, en la contraseña se lee el nombre del usuario "
#: src/error.c:47
-msgid ""
-"The password contains words from the real name of the user in some form"
-msgstr "De alguna manera, en la contraseña existen palabras del nombre real del usuario"
+msgid "The password contains words from the real name of the user in some form"
+msgstr ""
+"De alguna manera, en la contraseña existen palabras del nombre real del "
+"usuario"
#: src/error.c:49
msgid "The password contains forbidden words in some form"
@@ -168,37 +173,47 @@
#: src/error.c:87
msgid "The password does not contain enough character classes"
-msgstr "La contraseña no contiene la suficiente cantidad de clases de caracteres"
+msgstr ""
+"La contraseña no contiene la suficiente cantidad de clases de caracteres"
#: src/error.c:90
#, c-format
msgid "The password contains more than %ld same characters consecutively"
-msgstr "La contraseña contiene más de %ld caracteres iguales en forma consecutiva"
+msgstr ""
+"La contraseña contiene más de %ld caracteres iguales en forma consecutiva"
#: src/error.c:93
msgid "The password contains too many same characters consecutively"
-msgstr "La contraseña contiene en forma consecutiva demasiados caracteres iguales"
+msgstr ""
+"La contraseña contiene en forma consecutiva demasiados caracteres iguales"
#: src/error.c:96
#, c-format
msgid ""
"The password contains more than %ld characters of the same class "
"consecutively"
-msgstr "La contraseña contiene m ás de %ld caracteres de la misma clase en forma consecutiva"
+msgstr ""
+"La contraseña contiene m ás de %ld caracteres de la misma clase en forma "
+"consecutiva"
#: src/error.c:99
msgid ""
"The password contains too many characters of the same class consecutively"
-msgstr "La contraseña contiene en forma consecutiva demasiados caracteres de la misma clase"
+msgstr ""
+"La contraseña contiene en forma consecutiva demasiados caracteres de la "
+"misma clase"
#: src/error.c:102
#, c-format
msgid "The password contains monotonic sequence longer than %ld characters"
-msgstr "La contraseña contiene una secuencia monotónica mayor de %ld caracteres"
+msgstr ""
+"La contraseña contiene una secuencia monotónica mayor de %ld caracteres"
#: src/error.c:105
msgid "The password contains too long of a monotonic character sequence"
-msgstr "La contraseña contiene una secuencia de caracteres monotónica demasiado extensa"
+msgstr ""
+"La contraseña contiene una secuencia de caracteres monotónica demasiado "
+"extensa"
#: src/error.c:107
msgid "No password supplied"
@@ -210,7 +225,9 @@
#: src/error.c:111
msgid "Password generation failed - required entropy too low for settings"
-msgstr "Falló la creación de la contraseña - es necesaria una entropía demasiado pequeña para las configuraciones"
+msgstr ""
+"Falló la creación de la contraseña - es necesaria una entropía demasiado "
+"pequeña para las configuraciones"
#: src/error.c:114 src/error.c:117
msgid "The password fails the dictionary check"
changeset 306324aced04 in /srv/hg/libpwquality
details: http://hg.fedorahosted.org/hg/srv/hg/libpwquality?cmd=changeset;node=306324…
summary: Convert manual pages to pod format for easier creation.
diffstat:
doc/man/Makefile.am | 14 +
doc/man/pam_pwquality.8 | 413 -------------------------------------------
doc/man/pam_pwquality.8.pod | 309 ++++++++++++++++++++++++++++++++
doc/man/pwmake.1 | 45 ----
doc/man/pwmake.1.pod | 48 ++++
doc/man/pwquality.conf.5 | 133 -------------
doc/man/pwquality.conf.5.pod | 123 ++++++++++++
doc/man/pwscore.1 | 48 ----
doc/man/pwscore.1.pod | 51 +++++
9 files changed, 545 insertions(+), 639 deletions(-)
diffs (1223 lines):
diff -r b4f44d75bcba -r 306324aced04 doc/man/Makefile.am
--- a/doc/man/Makefile.am Fri Jul 17 17:08:43 2015 +0200
+++ b/doc/man/Makefile.am Wed Jul 22 16:41:01 2015 +0200
@@ -3,3 +3,17 @@
if HAVE_PAM
dist_man_MANS += pam_pwquality.8
endif
+
+EXTRA_DIST=pam_pwquality.8.pod pwmake.1.pod pwscore.1.pod pwquality.conf.5.pod
+
+%.8: %.8.pod
+ bash -c 'declare -u ucname=$*; pod2man --utf8 --name="$$ucname" --section=8 --center="Linux-PAM Manual" --release="Red Hat, Inc." $< $@'
+
+%.1: %.1.pod
+ bash -c 'declare -u ucname=$*; pod2man --utf8 --name="$$ucname" --section=1 --center="General Commands Manual" --release="Red Hat, Inc." $< $@'
+
+%.5: %.5.pod
+ bash -c 'declare -u ucname=$*; pod2man --utf8 --name="$$ucname" --section=5 --center="File Formats Manual" --release="Red Hat, Inc." $< $@'
+
+manclean:
+ rm *.8 *.1 *.5
diff -r b4f44d75bcba -r 306324aced04 doc/man/pam_pwquality.8
--- a/doc/man/pam_pwquality.8 Fri Jul 17 17:08:43 2015 +0200
+++ /dev/null Thu Jan 01 00:00:00 1970 +0000
@@ -1,413 +0,0 @@
-.\" Escape single quotes in literal strings from groff's Unicode transform.
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.de FN
-\fI\|\\$1\|\fP
-..
-.TH PAM_PWQUALITY 8 "16 Jul 2015" "Red Hat, Inc."
-.SH NAME
-pam_pwquality \- PAM module to perform password quality checking
-.SH SYNOPSIS
-\fBpam_pwquality\&.so\fR [\fI\&.\&.\&.\fR]
-.SH DESCRIPTION
-.PP
-This module can be plugged into the
-\fIpassword\fR
-stack of a given service to provide some plug\-in strength\-checking
-for passwords\&. The code was originally based on pam_cracklib module
-and the module is backwards compatible with its options\&.
-.PP
-The action of this module is to prompt the user for a password and check
-its strength against a system dictionary and a set of rules for identifying
-poor choices\&.
-.PP
-The first action is to prompt for a single password, check its strength
-and then, if it is considered strong, prompt for the password a second time
-(to verify that it was typed correctly on the first occasion)\&. All being
-well, the password is passed on to subsequent modules to be installed as the
-new authentication token\&.
-.PP
-The strength checks works in the following manner: at first the
-\fBCracklib\fR
-routine is called to check if the password is part of a dictionary; if this
-is not the case an additional set of strength checks is done\&. These checks
-are:
-.PP
-Palindrome
-.RS 4
-Is the new password a palindrome?
-.RE
-.PP
-Case Change Only
-.RS 4
-Is the new password the the old one with only a change of case?
-.RE
-.PP
-Similar
-.RS 4
-Is the new password too much like the old one? This is primarily controlled
-by one argument,
-\fBdifok\fR
-which is a number of character changes (inserts, removals, or replacements)
-between the old and new password that are enough to accept the new
-password\&.
-.RE
-.PP
-Simple
-.RS 4
-Is the new password too small? This is controlled by 6 arguments
-\fBminlen\fR,
-\fBmaxclassrepeat\fR,
-\fBdcredit\fR,
-\fBucredit\fR,
-\fBlcredit\fR, and
-\fBocredit\fR\&. See the section on the arguments for the details of how
-these work and there defaults\&.
-.RE
-.PP
-Rotated
-.RS 4
-Is the new password a rotated version of the old password?
-.RE
-.PP
-Same consecutive characters
-.RS 4
-Optional check for same consecutive characters\&.
-.RE
-.PP
-Too long monotonic character sequence
-.RS 4
-Optional check for too long monotonic character sequence\&.
-.RE
-.PP
-Contains user name
-.RS 4
-Optional check whether the password contains the user\*(Aqs name in some form\&.
-.RE
-.PP
-These checks are configurable either by use of the module arguments
-or by modifying the \fB/etc/security/pwquality.conf\fR configuration file\&. The
-module arguments override the settings in the configuration file\&.
-.PD
-.SH OPTIONS
-.PP
-\fBdebug\fR
-.RS 4
-This option makes the module write information to
-\fBsyslog\fR(3)
-indicating the behavior of the module (this option does not write password
-information to the log file)\&.
-.RE
-.PP
-\fBauthtok_type=\fR\fB\fIXXX\fR\fR
-.RS 4
-The default action is for the module to use the following prompts when
-requesting passwords: "New UNIX password: " and
-"Retype UNIX password: "\&. The example word
-\fIUNIX\fR
-can be replaced with this option, by default it is empty\&.
-.RE
-.PP
-\fBretry=\fR\fB\fIN\fR\fR
-.RS 4
-Prompt user at most
-\fIN\fR
-times before returning with error\&. The default is
-\fI1\fR\&.
-.RE
-.PP
-\fBdifok=\fR\fB\fIN\fR\fR
-.RS 4
-This argument will change the default of
-\fI1\fR
-for the number of changes in the new password from the old password\&.
-.RE
-.PP
-\fBminlen=\fR\fB\fIN\fR\fR
-.RS 4
-The minimum acceptable size for the new password (plus one if credits are not
-disabled which is the default)\&. In addition to the number of characters in
-the new password, credit (of +1 in length) is given for each different kind
-of character (\fIother\fR,
-\fIupper\fR,
-\fIlower\fR
-and
-\fIdigit\fR)\&. The default for this parameter is
-\fI8\fR
-\&. Note that there is a pair of length limits also in
-\fICracklib\fR,
-which is used for dictionary checking, a "way too short" limit of 4 which
-is hard coded in and a build time defined limit (6) that will be checked
-without reference to \fBminlen\fR\&.
-.RE
-.PP
-\fBdcredit=\fR\fB\fIN\fR\fR
-.RS 4
-(N >= 0) This is the maximum credit for having digits in the new password\&.
-If you have less than or
-\fIN\fR
-digits, each digit will count +1 towards meeting the current
-\fBminlen\fR
-value\&. The default for
-\fBdcredit\fR
-is
-\fI0\fR
-which means there is no bonus for digits in password\&.
-.sp
-(N < 0) This is the minimum number of digits that must be met for a new
-password\&.
-.RE
-.PP
-\fBucredit=\fR\fB\fIN\fR\fR
-.RS 4
-(N >= 0) This is the maximum credit for having upper case letters in the
-new password\&. If you have less than or
-\fIN\fR
-upper case letters each letter will count +1 towards meeting the current
-\fBminlen\fR
-value\&. The default for
-\fBucredit\fR
-is
-\fI0\fR
-which means there is no bonus for upper case letters in password\&.
-.sp
-(N < 0) This is the minimum number of upper case letters that must be met
-for a new password\&.
-.RE
-.PP
-\fBlcredit=\fR\fB\fIN\fR\fR
-.RS 4
-(N >= 0) This is the maximum credit for having lower case letters in the
-new password\&. If you have less than or
-\fIN\fR
-lower case letters, each letter will count +1 towards meeting the current
-\fBminlen\fR
-value\&. The default for
-is
-\fI0\fR
-which means there is no bonus for lower case letters in password\&.
-.sp
-(N < 0) This is the minimum number of lower case letters that must be met
-for a new password\&.
-.RE
-.PP
-\fBocredit=\fR\fB\fIN\fR\fR
-.RS 4
-(N >= 0) This is the maximum credit for having other characters in the new
-password\&. If you have less than or
-\fIN\fR
-other characters, each character will count +1 towards meeting the current
-\fBminlen\fR
-value\&. The default for
-\fBocredit\fR
-is
-\fI0\fR
-which means there is no bonus for other characters in password\&.
-.sp
-(N < 0) This is the minimum number of other characters that must be met for
-a new password\&.
-.RE
-.PP
-\fBminclass=\fR\fB\fIN\fR\fR
-.RS 4
-The minimum number of required classes of characters for the new password\&.
-The default number is zero\&. The four classes are digits, upper and lower
-letters and other characters\&. The difference to the
-\fBcredit\fR
-check is that a specific class if of characters is not required\&. Instead
-\fIN\fR
-out of four of the classes are required\&.
-.RE
-.PP
-\fBmaxrepeat=\fR\fB\fIN\fR\fR
-.RS 4
-Reject passwords which contain more than N same consecutive characters\&.
-The default is 0 which means that this check is disabled\&.
-.RE
-.PP
-\fBmaxsequence=\fR\fB\fIN\fR\fR
-.RS 4
-Reject passwords which contain monotonic character sequences longer than N\&.
-The default is 0 which means that this check is disabled\&.
-Examples of such sequence are \*(Aq12345\*(Aq or \*(Aqfedcb\*(Aq\&. Note that
-most such passwords will not pass the simplicity check unless the sequence
-is only a minor part of the password\&.
-.RE
-.PP
-\fBmaxclassrepeat=\fR\fB\fIN\fR\fR
-.RS 4
-Reject passwords which contain more than N consecutive characters of the
-same class\&.
-The default is 0 which means that this check is disabled\&.
-.RE
-.PP
-\fBgecoscheck=\fR\fB\fIN\fR\fR
-.RS 4
-If nonzero, check whether the individual words longer than 3 characters
-from the
-\fBpasswd GECOS\fR
-field of the user are contained in the new password\&.
-The default is 0 which means that this check is disabled\&.
-.RE
-.PP
-\fBdictcheck=\fR\fB\fIN\fR\fR
-.RS 4
-If nonzero, check whether the password (with possible modifications)
-matches a word in a dictionary\&. Currently the dictionary check is performed
-using the
-\fBcracklib\fR
-library\&.
-The default is 1 which means that this check is enabled\&.
-.RE
-.PP
-\fBbadwords=\fR\fB\fI<list of words>\fR\fR
-.RS 4
-The words more than 3 characters long from this space separated list are
-individually searched for and forbidden in the new password\&.
-By default the list is empty which means that this check is disabled\&.
-.RE
-.PP
-\fBenforce_for_root\fR
-.RS 4
-The module will return error on failed check even if the user changing the
-password is root\&. This option is off by default which means that just
-the message about the failed check is printed but root can change
-the password anyway\&. Note that root is not asked for an old password
-so the checks that compare the old and new password are not performed\&.
-.RE
-.PP
-\fBlocal_users_only\fR
-.RS 4
-The module will not test the password quality for users that are not present
-in the \fI/etc/passwd\fR file\&. The module still asks for the password so
-the following modules in the stack can use the \fBuse_authtok\fR option\&.
-This option is off by default\&.
-.RE
-.PP
-\fBuse_authtok\fR
-.RS 4
-This argument is used to
-\fIforce\fR
-the module to not prompt the user for a new password but use the one
-provided by the previously stacked
-\fIpassword\fR
-module\&.
-.RE
-.PP
-\fBdictpath=\fR\fB\fI/path/to/dict\fR\fR
-.RS 4
-Path to the cracklib dictionaries\&.
-.RE
-
-.PD
-.SH "MODULE TYPES PROVIDED"
-.PP
-Only the
-\fBpassword\fR
-module type is provided\&.
-
-.PD
-.SH "RETURN VALUES"
-.PP
-.PP
-PAM_SUCCESS
-.RS 4
-The new password passes all checks\&.
-.RE
-.PP
-PAM_AUTHTOK_ERR
-.RS 4
-No new password was entered, the username could not be determined or the
-new password fails the strength checks\&.
-.RE
-.PP
-PAM_AUTHTOK_RECOVERY_ERR
-.RS 4
-The old password was not supplied by a previous stacked module or got not
-requested from the user\&. The first error can happen if
-\fBuse_authtok\fR
-is specified\&.
-.RE
-.PP
-PAM_SERVICE_ERR
-.RS 4
-A internal error occurred\&.
-.RE
-.SH "EXAMPLES"
-.PP
-For an example of the use of this module, we show how it may be stacked with the password component of
-\fBpam_unix\fR(8)
-.sp
-.if n \{\
-.RS 4
-.\}
-.nf
-#
-# These lines stack two password type modules\&. In this example the
-# user is given 3 opportunities to enter a strong password\&. The
-# "use_authtok" argument ensures that the pam_unix module does not
-# prompt for a password, but instead uses the one provided by
-# pam_pwquality\&.
-#
-passwd password required pam_pwquality\&.so retry=3
-passwd password required pam_unix\&.so use_authtok
-
-.fi
-.if n \{\
-.RE
-.\}
-.PP
-Another example (in the
-/etc/pam\&.d/passwd
-format) is for the case that you want to use md5 password encryption:
-.sp
-.if n \{\
-.RS 4
-.\}
-.nf
-#%PAM\-1\&.0
-#
-# These lines allow a md5 systems to support passwords of at least 14
-# bytes with extra credit of 2 for digits and 2 for others the new
-# password must have at least three bytes that are not present in the
-# old password
-#
-password required pam_pwquality\&.so \e
- difok=3 minlen=15 dcredit= 2 ocredit=2
-password required pam_unix\&.so use_authtok nullok md5
-
-.fi
-.if n \{\
-.RE
-.\}
-.PP
-And here is another example in case you don\'t want to use credits:
-.sp
-.if n \{\
-.RS 4
-.\}
-.nf
-#%PAM\-1\&.0
-#
-# These lines require the user to select a password with a minimum
-# length of 8 and with at least 1 digit number, 1 upper case letter,
-# and 1 other character
-#
-password required pam_pwquality\&.so \e
- dcredit=\-1 ucredit=\-1 ocredit=\-1 lcredit=0 minlen=8
-password required pam_unix\&.so use_authtok nullok md5
-.fi
-.if n \{\
-.RE
-.\}
-.sp
-.PD
-.SH "SEE ALSO"
-pwscore(1), pwquality.conf(5), pam_pwquality(8),
-pam.conf(5), PAM(8)
-
-.SH AUTHORS
-.nf
-Tomas Mraz <tmraz(a)redhat\&.com>
-Original author of pam_cracklib module Cristian Gafton <gafton(a)redhat\&.com>
-.fi
diff -r b4f44d75bcba -r 306324aced04 doc/man/pam_pwquality.8.pod
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/doc/man/pam_pwquality.8.pod Wed Jul 22 16:41:01 2015 +0200
@@ -0,0 +1,309 @@
+=pod
+
+=head1 NAME
+
+pam_pwquality - PAM module to perform password quality checking
+
+=head1 SYNOPSIS
+
+B<pam_pwquality.so> [I<...>]
+
+=head1 DESCRIPTION
+
+This module can be plugged into the B<password> stack of a given service
+to provide some plug-in strength-checking for passwords.
+The code was originally based on pam_cracklib module and the module is
+backwards compatible with its options.
+
+The action of this module is to prompt the user for a password and check
+its strength against a system dictionary and a set of rules for identifying
+poor choices.
+
+The first action is to prompt for a single password, check its strength
+and then, if it is considered strong, prompt for the password a second time
+(to verify that it was typed correctly on the first occasion). All being
+well, the password is passed on to subsequent modules to be installed as the
+new authentication token.
+
+The checks for strength are:
+
+=over 4
+
+=item Palindrome
+
+Is the new password a palindrome?
+
+=item Case Change Only
+
+Is the new password the the old one with only a change of case?
+
+=item Similar
+
+Is the new password too much like the old one? This is primarily controlled
+by one argument, B<difok> which is a number of character changes (inserts,
+removals, or replacements) between the old and new password that are enough
+to accept the new password.
+
+=item Simple
+
+Is the new password too small? This is controlled by 6 arguments
+B<minlen>, B<maxclassrepeat>, B<dcredit>, B<ucredit>, B<lcredit>,
+and B<ocredit>. See the section on the arguments for the details of how
+these work and there defaults.
+
+=item Rotated
+
+Is the new password a rotated version of the old password?
+
+=item Same consecutive characters
+
+Optional check for same consecutive characters.
+
+=item Too long monotonic character sequence
+
+Optional check for too long monotonic character sequence.
+
+=item Contains user name
+
+Optional check whether the password contains the user's name in some form.
+
+=item Dictionary check
+
+The I<Cracklib> routine is called to check if the password is part of
+a dictionary.
+
+=back
+
+These checks are configurable either by use of the module arguments
+or by modifying the F</etc/security/pwquality.conf> configuration file. The
+module arguments override the settings in the configuration file.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<debug>
+
+This option makes the module write information to L<syslog(3)>
+indicating the behavior of the module (this option does not write password
+information to the log file).
+
+=item B<authtok_type=>I<XXX>
+
+The default action is for the module to use the following prompts when
+requesting passwords: C<"New UNIX password: "> and
+C<"Retype UNIX password: ">. The example word
+I<UNIX> can be replaced with this option, by default it is empty.
+
+=item B<retry=>I<N>
+
+Prompt user at most I<N> times before returning with error. The default is
+I<1>.
+
+=item B<difok=>I<N>
+
+This argument will change the default of I<1> for the number of changes in
+the new password from the old password.
+
+=item B<minlen=>I<N>
+
+The minimum acceptable size for the new password (plus one if credits are not
+disabled which is the default). In addition to the number of characters in
+the new password, credit (of +1 in length) is given for each different kind
+of character (I<other>, I<upper>, I<lower> and I<digit>). The default for this
+parameter is I<8>. Note that there is a pair of length limits also in
+I<Cracklib>, which is used for dictionary checking, a "way too short" limit
+of I<4> which is hard coded in and a build time defined limit (I<6>) that will
+be checked without reference to B<minlen>.
+
+=item B<dcredit=>I<N>
+
+(N >= 0) This is the maximum credit for having digits in the new password.
+If you have less than or I<N> digits, each digit will count +1 towards meeting
+the current B<minlen> value. The default for B<dcredit> is I<0>
+which means there is no bonus for digits in password.
+
+(N < 0) This is the minimum number of digits that must be met for a new
+password.
+
+=item B<ucredit=>I<N>
+
+(N >= 0) This is the maximum credit for having upper case letters in the new password.
+If you have less than or I<N> upper case letters, each upper case letter will count +1 towards meeting
+the current B<minlen> value. The default for B<ucredit> is I<0>
+which means there is no bonus for upper case letters in password.
+
+(N < 0) This is the minimum number of upper case letters that must be met for a new
+password.
+
+=item B<lcredit=>I<N>
+
+(N >= 0) This is the maximum credit for having lower case letters in the new password.
+If you have less than or I<N> lower case letters, each lower case letter will count +1 towards meeting
+the current B<minlen> value. The default for B<lcredit> is I<0>
+which means there is no bonus for lower case letters in password.
+
+(N < 0) This is the minimum number of lower case letters that must be met for a new
+password.
+
+=item B<ocredit=>I<N>
+
+(N >= 0) This is the maximum credit for having other characters in the new password.
+If you have less than or I<N> other characters, each other character will count +1 towards meeting
+the current B<minlen> value. The default for B<ocredit> is I<0>
+which means there is no bonus for other characters in password.
+
+(N < 0) This is the minimum number of other characters that must be met for a new
+password.
+
+=item B<minclass=>I<N>
+
+The minimum number of required classes of characters for the new password.
+The four classes are digits, upper and lower letters and other characters.
+The difference to the B<credit> check is that a specific class if of
+characters is not required. Instead I<N> out of four of the classes are
+required. By default the check is disabled.
+
+=item B<maxrepeat=>I<N>
+
+Reject passwords which contain more than I<N> same consecutive characters.
+The default is 0 which means that this check is disabled.
+
+=item B<maxsequence=>I<N>
+
+Reject passwords which contain monotonic character sequences longer than I<N>.
+The default is 0 which means that this check is disabled.
+Examples of such sequence are '12345' or 'fedcb'. Note that
+most such passwords will not pass the simplicity check unless the sequence
+is only a minor part of the password.
+
+=item B<maxclassrepeat=>I<N>
+
+Reject passwords which contain more than I<N> consecutive characters of the
+same class. The default is 0 which means that this check is disabled.
+
+=item B<gecoscheck=>I<N>
+
+If nonzero, check whether the individual words longer than 3 characters
+from the L<passwd(5)> GECOS field of the user are contained in the new
+password. The default is 0 which means that this check is disabled.
+
+=item B<dictcheck=>I<N>
+
+If nonzero, check whether the password (with possible modifications)
+matches a word in a dictionary. Currently the dictionary check is performed
+using the I<cracklib> library. The default is 1 which means that this check
+is enabled.
+
+=item B<badwords=>I<< <list of words> >>
+
+The words more than 3 characters long from this space separated list are
+individually searched for and forbidden in the new password.
+By default the list is empty which means that this check is disabled.
+
+=item B<dictpath=>I</path/to/dict>
+
+This options allows for specification of non-default path to the cracklib
+dictionaries.
+
+=item B<enforce_for_root>
+
+The module will return error on failed check even if the user changing the
+password is root. This option is off by default which means that just
+the message about the failed check is printed but root can change
+the password anyway. Note that root is not asked for an old password
+so the checks that compare the old and new password are not performed.
+
+=item B<local_users_only>
+
+The module will not test the password quality for users that are not present
+in the F</etc/passwd> file. The module still asks for the password so
+the following modules in the stack can use the B<use_authtok> option.
+This option is off by default.
+
+=item B<use_authtok>
+
+This argument is used to I<force> the module to not prompt the user for
+a new password but use the one provided by the previously stacked
+B<password> module.
+
+=back
+
+=head1 MODULE TYPES PROVIDED
+
+Only the B<password> module type is provided.
+
+=head1 RETURN VALUES
+
+=over 4
+
+=item PAM_SUCCESS
+
+The new password passes all checks.
+
+=item PAM_AUTHTOK_ERR
+
+No new password was entered, the username could not be determined or the
+new password fails the strength checks.
+
+=item PAM_AUTHTOK_RECOVERY_ERR
+
+The old password was not supplied by a previous stacked module or got not
+requested from the user. The first error can happen if B<use_authtok>
+is specified.
+
+=item PAM_SERVICE_ERR
+
+A internal error occurred.
+
+=back
+
+=head1 EXAMPLES
+
+For an example of the use of this module, we show how it may be stacked
+with the password component of L<pam_unix(8)>.
+
+ #
+ # These lines stack two password type modules. In this example the
+ # user is given 3 opportunities to enter a strong password. The
+ # "use_authtok" argument ensures that the pam_unix module does not
+ # prompt for a password, but instead uses the one provided by
+ # pam_pwquality.
+ #
+ password required pam_pwquality.so retry=3
+ password required pam_unix.so use_authtok
+
+Another example is for the case that you want to use sha256 password
+encryption:
+
+ #
+ # These lines allow modern systems to support passwords of at least 14
+ # bytes with extra credit of 2 for digits and 2 for others the new
+ # password must have at least three bytes that are not present in the
+ # old password
+ #
+ password required pam_pwquality.so \
+ difok=3 minlen=15 dcredit=2 ocredit=2
+ password required pam_unix.so use_authtok nullok sha256
+
+And here is another example in case you don't want to use credits:
+
+ #
+ # These lines require the user to select a password with a minimum
+ # length of 8 and with at least 1 digit number, 1 upper case letter,
+ # and 1 other character
+ #
+ password required pam_pwquality.so \
+ dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8
+ password required pam_unix.so use_authtok nullok sha256
+
+=head1 SEE ALSO
+
+L<pwscore(1)>, L<pwquality.conf(5)>, L<pam_pwquality(8)>,
+L<pam.conf(5)>, L<PAM(8)>
+
+=head1 AUTHORS
+
+Tomas Mraz <tmraz(a)redhat.com>
+
+Original author of B<pam_cracklib> module Cristian Gafton <gafton(a)redhat.com>
diff -r b4f44d75bcba -r 306324aced04 doc/man/pwmake.1
--- a/doc/man/pwmake.1 Fri Jul 17 17:08:43 2015 +0200
+++ /dev/null Thu Jan 01 00:00:00 1970 +0000
@@ -1,45 +0,0 @@
-.de FN
-\fI\|\\$1\|\fP
-..
-.TH PWMAKE 1 "10 Nov 2011" "Red Hat, Inc."
-.SH NAME
-pwmake \- simple tool for generating random relatively easily pronounceable
-passwords
-.SH SYNOPSIS
-\fBpwmake\fR <entropy-bits>
-.SH DESCRIPTION
-\fBpwmake\fR is a simple configurable tool for generating random and relatively
-easily pronounceable passwords. The tool allows you to specify the number of
-entropy bits that are used to generate the password.
-
-The entropy is pulled from \fB/dev/urandom\fR.
-
-The minimum number of bits is \fB56\fR which is usable for passwords on
-systems/services where brute force attacks are of very limited rate of tries.
-The \fB64\fR bits should be adequate for applications where the attacker
-does not have direct access to the password hash file. For situations where
-the attacker might obtain the direct access to the password hash or the
-password is used as an encryption key \fB80\fR to \fB128\fR bits should be
-used depending on your level of paranoia.
-
-.PD
-.SH OPTIONS
-The first and only argument is the number of bits of entropy used to generate
-the password.
-
-.SH FILES
-\fB/etc/security/pwquality.conf\fR - The configuration file for the libpwquality
-library.
-
-.PD
-.SH "RETURN CODES"
-\fBpwmake\fR returns 0 on success, non zero on error.
-
-.PD
-.SH "SEE ALSO"
-pwscore(1), pam_pwquality(8)
-
-.SH AUTHORS
-.nf
-Tomas Mraz <tmraz(a)redhat.com>
-.fi
diff -r b4f44d75bcba -r 306324aced04 doc/man/pwmake.1.pod
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/doc/man/pwmake.1.pod Wed Jul 22 16:41:01 2015 +0200
@@ -0,0 +1,48 @@
+=pod
+
+=head1 NAME
+
+B<pwmake> - simple tool for generating random relatively easily pronounceable
+passwords
+
+=head1 SYNOPSIS
+
+B<pwmake> I<< <entropy-bits> >>
+
+=head1 DESCRIPTION
+
+B<pwmake> is a simple configurable tool for generating random and relatively
+easily pronounceable passwords. The tool allows you to specify the number of
+entropy bits that are used to generate the password.
+
+The entropy is pulled from F</dev/urandom>.
+
+The minimum number of bits is I<56> which is usable for passwords on
+systems/services where brute force attacks are of very limited rate of tries.
+The I<64> bits should be adequate for applications where the attacker
+does not have direct access to the password hash file. For situations where
+the attacker might obtain the direct access to the password hash or the
+password is used as an encryption key I<80> to I<128> bits should be
+used depending on your level of paranoia.
+
+=head1 OPTIONS
+
+The first and only argument is the number of bits of entropy used to generate
+the password.
+
+=head1 FILES
+
+F</etc/security/pwquality.conf> - The configuration file for the libpwquality
+library.
+
+=head1 RETURN CODES
+
+B<pwmake> returns 0 on success, non zero on error.
+
+=head1 SEE ALSO
+
+L<pwscore(1)>, L<pam_pwquality(8)>
+
+=head1 AUTHORS
+
+Tomas Mraz <tmraz(a)redhat.com>
diff -r b4f44d75bcba -r 306324aced04 doc/man/pwquality.conf.5
--- a/doc/man/pwquality.conf.5 Fri Jul 17 17:08:43 2015 +0200
+++ /dev/null Thu Jan 01 00:00:00 1970 +0000
@@ -1,133 +0,0 @@
-.\" Escape single quotes in literal strings from groff's Unicode transform.
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.de FN
-\fI\|\\$1\|\fP
-..
-.TH PWQUALITY.CONF 5 "16 Jul 2015" "Red Hat, Inc."
-.SH NAME
-pwquality.conf \- configuration for the libpwquality library
-.SH SYNOPSIS
-\fB/etc/security/pwquality.conf\fR
-\fB/etc/security/pwquality.conf.d/*.conf\fR
-.SH DESCRIPTION
-\fBpwquality.conf\fR provides a way to configure the default password
-quality requirements for the system passwords. This file is read by the
-libpwquality library and utilities that use this library for checking
-and generating passwords.
-
-The file has a very simple \fIname = value\fR format with possible comments
-starting with \fB#\fR character. The whitespace at the beginning of line, end
-of line, and around the \fB=\fR sign is ignored.
-
-The libpwquality library also first reads all \fB*.conf\fR files from the
-\fB/etc/security/pwquality.conf.d\fR directory in ASCII sorted order. The
-values of the same settings are overriden in the order the files are parsed.
-.PD
-.SH OPTIONS
-The possible options in the file are:
-.RS 4
-.PP
-\fBdifok\fR
-.RS 4
-Number of characters in the new password that must not be present in the
-old password. (default 1)
-.RE
-.PP
-\fBminlen\fR
-.RS 4
-Minimum acceptable size for the new password (plus one if credits are not
-disabled which is the default). (See \fIpam_pwquality(8)\fR.)
-Cannot be set to lower value than 6. (default 8)
-.RE
-.PP
-\fBdcredit\fR
-.RS 4
-The maximum credit for having digits in the new password. If less than 0
-it is the minimum number of digits in the new password. (default 0)
-.RE
-.PP
-\fBucredit\fR
-.RS 4
-The maximum credit for having uppercase characters in the new password.
-If less than 0 it is the minimum number of uppercase characters in the new
-password. (default 0)
-.RE
-.PP
-\fBlcredit\fR
-.RS 4
-The maximum credit for having lowercase characters in the new password.
-If less than 0 it is the minimum number of lowercase characters in the new
-password. (default 0)
-.RE
-.PP
-\fBocredit\fR
-.RS 4
-The maximum credit for having other characters in the new password.
-If less than 0 it is the minimum number of other characters in the new
-password. (default 0)
-.RE
-.PP
-\fBminclass\fR
-.RS 4
-The minimum number of required classes of characters for the new
-password (digits, uppercase, lowercase, others). (default 0)
-.RE
-.PP
-\fBmaxrepeat\fR
-.RS 4
-The maximum number of allowed same consecutive characters in the new password.
-The check is disabled if the value is 0. (default 0)
-.RE
-.PP
-\fBmaxsequence\fR
-.RS 4
-The maximum length of monotonic character sequences in the new password.
-Examples of such sequence are \*(Aq12345\*(Aq or \*(Aqfedcb\*(Aq\&. Note
-that most such passwords will not pass the simplicity check unless
-the sequence is only a minor part of the password.
-The check is disabled if the value is 0. (default 0)
-.RE
-.PP
-\fBmaxclassrepeat\fR
-.RS 4
-The maximum number of allowed consecutive characters of the same class in the
-new password.
-The check is disabled if the value is 0. (default 0)
-.RE
-.PP
-\fBgecoscheck\fR
-.RS 4
-If nonzero, check whether the words longer than 3 characters from the GECOS
-field of the user's passwd entry are contained in the new password.
-The check is disabled if the value is 0. (default 0)
-.RE
-.PP
-\fBdictcheck\fR
-.RS 4
-If nonzero, check whether the password (with possible modifications)
-matches a word in a dictionary. Currently the dictionary check is performed
-using the cracklib library. (default 1)
-.RE
-.PP
-\fBbadwords\fR
-.RS 4
-Space separated list of words that must not be contained in the password. These
-are additional words to the cracklib dictionary check. This setting can be
-also used by applications to emulate the gecos check for user accounts that are
-not created yet.
-.RE
-.PP
-\fBdictpath\fR
-.RS 4
-Path to the cracklib dictionaries. Default is to use the cracklib default.
-.RE
-
-.PD
-.SH "SEE ALSO"
-pwscore(1), pwmake(1), pam_pwquality(8)
-
-.SH AUTHORS
-.nf
-Tomas Mraz <tmraz(a)redhat.com>
-.fi
diff -r b4f44d75bcba -r 306324aced04 doc/man/pwquality.conf.5.pod
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/doc/man/pwquality.conf.5.pod Wed Jul 22 16:41:01 2015 +0200
@@ -0,0 +1,123 @@
+=pod
+
+=head1 NAME
+
+pwquality.conf - configuration for the libpwquality library
+
+=head1 SYNOPSIS
+
+F</etc/security/pwquality.conf>
+
+F</etc/security/pwquality.conf.d/*.conf>
+
+=head1 DESCRIPTION
+
+B<pwquality.conf> provides a way to configure the default password
+quality requirements for the system passwords. This file is read by the
+libpwquality library and utilities that use this library for checking
+and generating passwords.
+
+The file has a very simple I<name = value> format with possible comments
+starting with C<#> character. The whitespace at the beginning of line, end
+of line, and around the C<=> sign is ignored.
+
+The libpwquality library also first reads all F<*.conf> files from the
+F</etc/security/pwquality.conf.d> directory in ASCII sorted order. The
+values of the same settings are overriden in the order the files are parsed.
+
+=head1 OPTIONS
+
+The possible options in the file are:
+
+=over 4
+
+=item B<difok>
+
+Number of characters in the new password that must not be present in the
+old password. (default 1)
+
+=item B<minlen>
+
+Minimum acceptable size for the new password (plus one if credits are not
+disabled which is the default). (See L<pam_pwquality(8)>.)
+Cannot be set to lower value than 6. (default 8)
+
+=item B<dcredit>
+
+The maximum credit for having digits in the new password. If less than 0
+it is the minimum number of digits in the new password. (default 0)
+
+=item B<ucredit>
+
+The maximum credit for having uppercase characters in the new password.
+If less than 0 it is the minimum number of uppercase characters in the new
+password. (default 0)
+
+=item B<lcredit>
+
+The maximum credit for having lowercase characters in the new password.
+If less than 0 it is the minimum number of lowercase characters in the new
+password. (default 0)
+
+=item B<ocredit>
+
+The maximum credit for having other characters in the new password.
+If less than 0 it is the minimum number of other characters in the new
+password. (default 0)
+
+=item B<minclass>
+
+The minimum number of required classes of characters for the new
+password (digits, uppercase, lowercase, others). (default 0)
+
+=item B<maxrepeat>
+
+The maximum number of allowed same consecutive characters in the new password.
+The check is disabled if the value is 0. (default 0)
+
+=item B<maxsequence>
+
+The maximum length of monotonic character sequences in the new password.
+Examples of such sequence are '12345' or 'fedcb'. Note
+that most such passwords will not pass the simplicity check unless
+the sequence is only a minor part of the password.
+The check is disabled if the value is 0. (default 0)
+
+=item B<maxclassrepeat>
+
+The maximum number of allowed consecutive characters of the same class in the
+new password.
+The check is disabled if the value is 0. (default 0)
+
+=item B<gecoscheck>
+
+If nonzero, check whether the words longer than 3 characters from the I<GECOS>
+field of the user's L<passwd(5)> entry are contained in the new password.
+The check is disabled if the value is 0. (default 0)
+
+=item B<dictcheck>
+
+If nonzero, check whether the password (with possible modifications)
+matches a word in a dictionary. Currently the dictionary check is performed
+using the cracklib library. (default 1)
+
+=item B<badwords>
+
+Space separated list of words that must not be contained in the password. These
+are additional words to the cracklib dictionary check. This setting can be
+also used by applications to emulate the gecos check for user accounts that are
+not created yet.
+
+=item B<dictpath>
+
+Path to the cracklib dictionaries. Default is to use the cracklib default.
+
+=back
+
+=head1 SEE ALSO
+
+L<pwscore(1)>, L<pwmake(1)>, L<pam_pwquality(8)>
+
+=head1 AUTHORS
+
+Tomas Mraz <tmraz(a)redhat.com>
diff -r b4f44d75bcba -r 306324aced04 doc/man/pwscore.1
--- a/doc/man/pwscore.1 Fri Jul 17 17:08:43 2015 +0200
+++ /dev/null Thu Jan 01 00:00:00 1970 +0000
@@ -1,48 +0,0 @@
-.de FN
-\fI\|\\$1\|\fP
-..
-.TH PWSCORE 1 "10 Nov 2011" "Red Hat, Inc."
-.SH NAME
-pwscore \- simple configurable tool for checking quality of a password
-.SH SYNOPSIS
-\fBpwscore\fR [user]
-.SH DESCRIPTION
-\fBpwscore\fR is a simple tool for checking quality of a password. The password
-is read from stdin.
-
-The tool uses the \fBlibpwquality\fR library to perform configurable checks
-for minimum length, dictionary checking against cracklib dictionaries,
-and other checks.
-
-It either reports an error if the password fails any of the checks, or it
-prints out the password quality score as an integer value between \fB0\fR and
-\fB100\fR.
-
-The password quality score is relative to the \fBminlen\fR setting in the
-configuration file. But in general values below 50 can be treated as moderate
-quality and above it fairly strong quality. Any password that passes the quality
-checks (especially the mandatory cracklib check) should withstand dictionary
-attacks and scores above 50 with the default minlen setting even fast brute
-force attacks.
-
-.PD
-.SH OPTIONS
-The first and only optional argument is the user name that is used to check
-the similarity of the password to the username.
-
-.SH FILES
-\fB/etc/security/pwquality.conf\fR - The configuration file for the libpwquality
-library.
-
-.PD
-.SH "RETURN CODES"
-\fBpwscore\fR returns 0 on success, non zero on error.
-
-.PD
-.SH "SEE ALSO"
-pwscore(1), pwquality.conf(5), pam_pwquality(8)
-
-.SH AUTHORS
-.nf
-Tomas Mraz <tmraz(a)redhat.com>
-.fi
diff -r b4f44d75bcba -r 306324aced04 doc/man/pwscore.1.pod
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/doc/man/pwscore.1.pod Wed Jul 22 16:41:01 2015 +0200
@@ -0,0 +1,51 @@
+=pod
+
+=head1 NAME
+
+pwscore - simple configurable tool for checking quality of a password
+
+=head1 SYNOPSIS
+
+B<pwscore> [I<user>]
+
+=head1 DESCRIPTION
+
+B<pwscore> is a simple tool for checking quality of a password. The password
+is read from stdin.
+
+The tool uses the B<libpwquality> library to perform configurable checks
+for minimum length, dictionary checking against cracklib dictionaries,
+and other checks.
+
+It either reports an error if the password fails any of the checks, or it
+prints out the password quality score as an integer value between I<0> and
+I<100>.
+
+The password quality score is relative to the B<minlen> setting in the
+configuration file. But in general values below 50 can be treated as moderate
+quality and above it fairly strong quality. Any password that passes the quality
+checks (especially the mandatory cracklib check) should withstand dictionary
+attacks and scores above 50 with the default minlen setting even fast brute
+force attacks.
+
+=head1 OPTIONS
+
+The first and only optional argument is the user name that is used to check
+the similarity of the password to the username.
+
+=head1 FILES
+
+F</etc/security/pwquality.conf> - The configuration file for the libpwquality
+library.
+
+=head1 RETURN CODES
+
+B<pwscore> returns 0 on success, non zero on error.
+
+=head1 SEE ALSO
+
+L<pwscore(1)>, L<pwquality.conf(5)>, L<pam_pwquality(8)>
+
+=head1 AUTHORS
+
+Tomas Mraz <tmraz(a)redhat.com>