changeset 2304ca444f0e in /srv/hg/libpwquality
details:
http://hg.fedorahosted.org/hg/srv/hg/libpwquality?cmd=changeset;node=2304...
summary: Add maxsequence check for too long monotonic character sequence.
diffstat:
doc/man/pam_pwquality.8 | 26 +++++++++++++++++++++-----
doc/man/pwquality.conf.5 | 9 +++++++++
python/pwquality.c | 5 +++++
src/check.c | 42 ++++++++++++++++++++++++++++++++++++++++++
src/error.c | 6 ++++++
src/pwqprivate.h | 1 +
src/pwquality.h | 2 ++
src/settings.c | 1 +
8 files changed, 87 insertions(+), 5 deletions(-)
diffs (214 lines):
diff -r 7b7242a0813a -r 2304ca444f0e doc/man/pam_pwquality.8
--- a/doc/man/pam_pwquality.8 Wed Jun 13 17:01:24 2012 +0200
+++ b/doc/man/pam_pwquality.8 Fri Jun 29 11:01:20 2012 +0200
@@ -27,7 +27,7 @@
The strength checks works in the following manner: at first the
\fBCracklib\fR
routine is called to check if the password is part of a dictionary; if this
-is not the case an additional set of strength checks are done\&. These checks
+is not the case an additional set of strength checks is done\&. These checks
are:
.PP
Palindrome
@@ -45,14 +45,16 @@
Is the new password too much like the old one? This is primarily controlled
by one argument,
\fBdifok\fR
-which is a number of changes between the old and new are enough to accept
-the new password\&.
+which is a number of character changes (inserts, removals, or replacements)
+between the old and new password that are enough to accept the new
+password\&. This defaults to 5 changes\&.
.RE
.PP
Simple
.RS 4
-Is the new password too small? This is controlled by 5 arguments
+Is the new password too small? This is controlled by 6 arguments
\fBminlen\fR,
+\fBmaxclassrepeat\fR,
\fBdcredit\fR,
\fBucredit\fR,
\fBlcredit\fR, and
@@ -70,9 +72,14 @@
Optional check for same consecutive characters\&.
.RE
.PP
+Too long monotonic character sequence
+.RS 4
+Optional check for too long monotonic character sequence\&.
+.RE
+.PP
Contains user name
.RS 4
-Optional check whether the password contains the user name in some form\&.
+Optional check whether the password contains the user\*(Aqs name in some form\&.
.RE
.PP
These checks are configurable either by use of the module arguments
@@ -217,6 +224,15 @@
The default is 0 which means that this check is disabled\&.
.RE
.PP
+\fBmaxsequence=\fR\fB\fIN\fR\fR
+.RS 4
+Reject passwords which contain monotonic character sequences longer than N\&.
+The default is 0 which means that this check is disabled\&.
+Examples of such sequence are \*(Aq12345\*(Aq or \*(Aqfedcb\*(Aq\&. Note that
+most such passwords will not pass the simplicity check unless the sequence
+is only a minor part of the password\&.
+.RE
+.PP
\fBmaxclassrepeat=\fR\fB\fIN\fR\fR
.RS 4
Reject passwords which contain more than N consecutive characters of the
diff -r 7b7242a0813a -r 2304ca444f0e doc/man/pwquality.conf.5
--- a/doc/man/pwquality.conf.5 Wed Jun 13 17:01:24 2012 +0200
+++ b/doc/man/pwquality.conf.5 Fri Jun 29 11:01:20 2012 +0200
@@ -73,6 +73,15 @@
The check is disabled if the value is 0. (default 0)
.RE
.PP
+\fBmaxsequence\fR
+.RS 4
+The maximum length of monotonic character sequences in the new password.
+Examples of such sequence are \*(Aq12345\*(Aq or \*(Aqfedcb\*(Aq\&. Note
+that most such passwords will not pass the simplicity check unless
+the sequence is only a minor part of the password.
+The check is disabled if the value is 0. (default 0)
+.RE
+.PP
\fBmaxclassrepeat\fR
.RS 4
The maximum number of allowed consecutive characters of the same class in the
diff -r 7b7242a0813a -r 2304ca444f0e python/pwquality.c
--- a/python/pwquality.c Wed Jun 13 17:01:24 2012 +0200
+++ b/python/pwquality.c Fri Jun 29 11:01:20 2012 +0200
@@ -107,6 +107,11 @@
"Maximum consecutive characters of the same class",
(void *)PWQ_SETTING_MAX_CLASS_REPEAT
},
+ { "maxsequence",
+ (getter)pwqsettings_getint, (setter)pwqsettings_setint,
+ "Maximum length of a monotonic character sequence",
+ (void *)PWQ_SETTING_MAX_SEQUENCE
+ },
{ "gecoscheck",
(getter)pwqsettings_getint, (setter)pwqsettings_setint,
"Match words from the passwd GECOS field if available",
diff -r 7b7242a0813a -r 2304ca444f0e src/check.c
--- a/src/check.c Wed Jun 13 17:01:24 2012 +0200
+++ b/src/check.c Fri Jun 29 11:01:20 2012 +0200
@@ -329,6 +329,45 @@
return 0;
}
+static int sequence(pwquality_settings_t *pwq, const char *new, void **auxerror)
+{
+ char c;
+ int i;
+ int sequp = 1;
+ int seqdown = 1;
+
+ if (pwq->max_sequence == 0)
+ return 0;
+
+ if (new[0] == '\0')
+ return 0;
+
+ for (i = 1; new[i]; i++) {
+ c = new[i-1];
+ if (new[i] == c+1) {
+ ++sequp;
+ if (sequp > pwq->max_sequence) {
+ if (auxerror)
+ *auxerror = (void *)(long)pwq->max_sequence;
+ return 1;
+ }
+ seqdown = 1;
+ } else if (new[i] == c-1) {
+ ++seqdown;
+ if (seqdown > pwq->max_sequence) {
+ if (auxerror)
+ *auxerror = (void *)(long)pwq->max_sequence;
+ return 1;
+ }
+ sequp = 1;
+ } else {
+ sequp = 1;
+ seqdown = 1;
+ }
+ }
+ return 0;
+}
+
static int
usercheck(pwquality_settings_t *pwq, const char *new,
char *user)
@@ -511,6 +550,9 @@
if (!rv && consecutive(pwq, new, auxerror))
rv = PWQ_ERROR_MAX_CONSECUTIVE;
+ if (!rv && sequence(pwq, new, auxerror))
+ rv = PWQ_ERROR_MAX_SEQUENCE;
+
if (!rv && usermono && usercheck(pwq, newmono, usermono))
rv = PWQ_ERROR_USER_CHECK;
diff -r 7b7242a0813a -r 2304ca444f0e src/error.c
--- a/src/error.c Wed Jun 13 17:01:24 2012 +0200
+++ b/src/error.c Fri Jun 29 11:01:20 2012 +0200
@@ -97,6 +97,12 @@
return buf;
}
return _("The password contains too many characters of the same
class consecutively");
+ case PWQ_ERROR_MAX_SEQUENCE:
+ if (auxerror) {
+ snprintf(buf, len, _("The password contains monotonic
sequence longer than %ld characters"), (long)auxerror);
+ return buf;
+ }
+ return _("The password contains too long of a monotonic character
sequence");
case PWQ_ERROR_EMPTY_PASSWORD:
return _("No password supplied");
case PWQ_ERROR_RNG:
diff -r 7b7242a0813a -r 2304ca444f0e src/pwqprivate.h
--- a/src/pwqprivate.h Wed Jun 13 17:01:24 2012 +0200
+++ b/src/pwqprivate.h Fri Jun 29 11:01:20 2012 +0200
@@ -22,6 +22,7 @@
int min_class;
int max_repeat;
int max_class_repeat;
+ int max_sequence;
int gecos_check;
char *bad_words;
char *dict_path;
diff -r 7b7242a0813a -r 2304ca444f0e src/pwquality.h
--- a/src/pwquality.h Wed Jun 13 17:01:24 2012 +0200
+++ b/src/pwquality.h Fri Jun 29 11:01:20 2012 +0200
@@ -22,6 +22,7 @@
#define PWQ_SETTING_MAX_CLASS_REPEAT 11
#define PWQ_SETTING_GECOS_CHECK 12
#define PWQ_SETTING_BAD_WORDS 13
+#define PWQ_SETTING_MAX_SEQUENCE 14
#define PWQ_MAX_ENTROPY_BITS 256
#define PWQ_MIN_ENTROPY_BITS 56
@@ -57,6 +58,7 @@
#define PWQ_ERROR_GECOS_CHECK -26
#define PWQ_ERROR_MAX_CLASS_REPEAT -27
#define PWQ_ERROR_BAD_WORDS -28
+#define PWQ_ERROR_MAX_SEQUENCE -29
typedef struct pwquality_settings pwquality_settings_t;
diff -r 7b7242a0813a -r 2304ca444f0e src/settings.c
--- a/src/settings.c Wed Jun 13 17:01:24 2012 +0200
+++ b/src/settings.c Fri Jun 29 11:01:20 2012 +0200
@@ -57,6 +57,7 @@
{ "minclass", PWQ_SETTING_MIN_CLASS, PWQ_TYPE_INT},
{ "maxrepeat", PWQ_SETTING_MAX_REPEAT, PWQ_TYPE_INT},
{ "maxclassrepeat", PWQ_SETTING_MAX_CLASS_REPEAT, PWQ_TYPE_INT},
+ { "maxsequence", PWQ_SETTING_MAX_SEQUENCE, PWQ_TYPE_INT},
{ "gecoscheck", PWQ_SETTING_GECOS_CHECK, PWQ_TYPE_INT},
{ "badwords", PWQ_SETTING_BAD_WORDS, PWQ_TYPE_STR},
{ "dictpath", PWQ_SETTING_DICT_PATH, PWQ_TYPE_STR}