On 05/30/2012 04:13 PM, Michael Palmiotto wrote:
> Some remaining issues exist, such as the prose not being
> quite good yet, and I believe we will also break apart the
> OVAL check for minimum length to separately cover the
> settings in login.defs and pam_cracklib. But not today.
I'm assuming this is one example of prose that needs
resolution:
> <pre>PASS_MIN_LEN=12
> <!-- <sub idref="var_password_min_len"> --></pre>
> TODO: More research needed to understand exact
> interaction: when precisely is this file consulted?
Yes. And the usage of "<sub idref=" should be supported by the
transforms (but currently isn't).
I was calling this out because although I think that my commit is a very
significant improvement, it's not completely done yet.
I am waiting for an ACK.
For the more applicable MD5 and SHA configurations,
the entire key is used, so maybe PASS_MIN_LEN
needs to be different for different ENCRYPT_METHOD
values?
PASS_MIN_LEN controls what the system will require for minimum password
length (at least for the usual programs in the "shadow password suite").
I am unaware of any USG password policy that adjusts its length
requirement based on relevant information such as the strength of the
underlying algorithm.