On Sep 28, 2012, at 9:50 AM, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Friday, September 28, 2012 01:27:25 PM Spencer R. Shimko wrote:
> Is anyone strongly bound to pam_cracklib? The reason I ask is that the
> prose and OVAL checks are currently written for pam_cracklib. pam_cracklib
> doesn't enforce complexity requirements on UID 0. pam_passwdqc can enforce
> password complexity requirements on root with the "enforce=everyone"
> option. Many requirement sets do not differentiate between privilege users
> and unprivileged users in the I&A sections. As a result I'd like to switch
> to passwdqc. Unless there is opposition we'll put together a patch to make
> the switch.
Yes, I would prefer to stay with pam_cracklib for a number of reasons. If
there were a deficiency in it, I'd rather open a bug report and fix it.
We did open a bug - way back in 2010 :P
https://bugzilla.redhat.com/show_bug.cgi?id=588893
I had hoped the feature would have been integrated into a release by this point but at
least it is being considered for RHEL 6.4. Until the feature is released I'm going to
have to stick with passwdqc and will use SecState's mitigation feature to explain why
we fail that check and why it is a false negative.
Can you share those reasons you prefer cracklib? I'm perfectly fine sticking with
cracklib if this feature is added. I do like passwdqc's simplicity though.
Thanks,
--Spencer
-Steve