linuxexpert-practice-labs/labs/linux-terminal/3-3-password-rules/README.md

Using Linux Terminal 3.3: Password complexity and expiry

Password rules with pam_pwquality, aging and account expiry for one user, and aging defaults for new accounts.

Before you start

Work as root (sudo -i). The lab creates users alice and pwtest (password Lab-Pass-1); try passwords out on pwtest, for example echo 'pwtest:lowercase12' | chpasswd, so alice's settings from task 2 stay as you made them. The rules only apply when a password is set, so they can't lock anyone out of logging in. The lab saves /etc/pam.d/common-password, the pwquality settings and /etc/login.defs, and puts them back on reset; reset also removes libpam-pwquality again if the lab started without it, and user dave if you made him.

Tasks

1. Install pam_pwquality and require passwords of at least 10 characters with at least one digit and one uppercase letter, for every user including root. echo 'pwtest:lowercase12' | chpasswd fails with "BAD PASSWORD: The password contains less than 1 uppercase letters", and echo 'pwtest:Kettle7-Harbor' | chpasswd succeeds.
2. Make alice's password expire every 60 days with 10 days' warning, disable her account on the last day of next year, and make her choose a new password at her next login.
3. Make new accounts' passwords expire after 120 days, without changing existing users. After useradd -m dave, chage -l dave shows maximum 120, and chage -l alice is unchanged.

Hints

• apt install libpam-pwquality; a file in /etc/security/pwquality.conf.d/ (make the directory) with minlen, dcredit = -1, ucredit = -1 and enforce_for_root.
• chage -M -W -E -d 0; check with chage -l alice.
• PASS_MAX_DAYS in /etc/login.defs.