pam_passwdqc vs pam_cracklib

Steve Grubb sgrubb at redhat.com
Fri Sep 28 13:50:44 UTC 2012


On Friday, September 28, 2012 01:27:25 PM Spencer R. Shimko wrote:
> Is anyone strongly bound to pam_cracklib?  The reason I ask is that the
> prose and OVAL checks are currently written for pam_cracklib.  pam_cracklib
> doesn't enforce complexity requirements on UID 0.  pam_passwdqc can enforce
> password complexity requirements on root with the "enforce=everyone"
> option.  Many requirement sets do not differentiate between privilege users
> and unprivileged users in the I&A sections.  As a result I'd like to switch
> to passwdqc.  Unless there is opposition we'll put together a patch to make
> the switch.

Yes, I would prefer to stay with pam_cracklib for a number of reasons. If 
there were a deficiency in it, I'd rather open a bug report and fix it.

-Steve


More information about the scap-security-guide mailing list