How do you enforce specific password syntax rules?

Question

Hi Guys,
I'm setting up iPlanet Directory Server 5.1.3 and I need to configure it to enforce a password rule which says that you must have at least one letter and one number in your password. I've searched the documentation and googled the heck out of it, but I can't seem to find any reference as to how to do that. Does anybody have any info on if this is possible and where I might look for some info on how to do it?
Thanks,
Mike

Answer 1

Thanks gary, excelent find, ive just installed it on solaris 10.
heres what happened when i tried to use a password
test
then tester
then tester1
$ passwd
passwd: Changing password for admin
Enter existing login password:
New Password:
passwd: Password too short - must be at least 6 characters.
Please try again
New Password:
passwd: The password must contain at least 1 numeric or special character(s).
Please try again
New Password:
Re-enter new Password:
Your new password was rejected for the following reason:
it is based on a dictionary word
Permission denied
to build get hold of pam_cracklib.tar.gz, from sourceforge and
cracklib,2.7.tar.gz
first cracklib, change the DICTPATH in the Makefile for
/usr/dict/pw_dict
do
CC=/opt/sfw/bin/gcc; export CC
and in the utils directory change the make file so all the cc's are gcc
then
make all
now cd cracklib and cp libcrack.a /usr/lib and packer.h to /usr/include
cd to the utils directory and copy all the binaries to /usr/bin
cp mkdict testlib testnum teststr unpacker /usr/bin
now move on to the pam part
unpack and cd to pam_cracklib
edit the GNUmakefile as follows or use this GNUmakefile
# !!! Hello !!!
# Make sure you are using GNU Make, and not some cheap imitation.
# !!! Thank you !!!
OS=$(shell uname)
ARCH=$(shell uname -p)
CRACKLIB_TARGET=pam_cracklib.so
DESTDIR=/usr/lib/security
PERMS=0700
PASSWORD_SRCS=pam_password.c
COMMON_SRCS=pam_module.c logging.c util.c
CRACKLIB_SRCS=cracklib.c $(COMMON_SRCS) $(PASSWORD_SRCS)
CRACKLIB_OBJS=$(CRACKLIB_SRCS:.c=.o)
DICTPATH="/usr/dict/pw_dict"
INCL=
LIBS=-lpam
CRACK_LIBS=-lcrack
CC=gcc
CFLAGS=-g -Wall -fPIC -D$(OS) -D$(ARCH)
LD=ld
ifeq ($(OS),SunOS)
LDFLAGS=-G -z redlocsym -L/usr/lib -R/usr/lib
else
LDFLAGS=-x --shared -L/usr/lib -R/usr/lib<br />
endif
RM=rm
FORCE_REBUILD=
password: $(CRACKLIB_TARGET)
# We will use this when cproto(1) stops sucking
# %.h : %.c $(FORCE_REBUILD) # A ".o" file depends on the corresponding ".c" fil
e
# cproto -E 0 $<
%.o : %.c $(FORCE_REBUILD) # A ".o" file depends on the corresponding ".c" file
$(CC) $(INCL) $(CFLAGS) -c $< -o $@
% : %.o # override default linking rule just in case
@echo
@echo $@ is not a valid target
@echo
$(CRACKLIB_TARGET) : CFLAGS += -DMODULE_NAME=\"$(CRACKLIB_TARGET)\" -DCRACKLIB_
DICTPATH=\"$(DICTPATH)\"
$(CRACKLIB_TARGET) : $(FORCE_REBUILD) $(CRACKLIB_OBJS)
$(LD) $(LDFLAGS) -o $@ $(CRACKLIB_OBJS) $(LIBS) $(CRACK_LIBS)
@echo
@echo $@ built successfully!
@echo
# Need -O so the inline "stat()" gets compiled, grr
$(DESTDIR)/$(CRACKLIB_TARGET) : $(CRACKLIB_TARGET)
@echo installing...
test -d $(DESTDIR) || mkdir -p $(DESTDIR)
cp $(CRACKLIB_TARGET) $(DESTDIR)
chown root $(DESTDIR)/$(CRACKLIB_TARGET)
chgrp root $(DESTDIR)/$(CRACKLIB_TARGET)
chmod $(PERMS) $(DESTDIR)/$(CRACKLIB_TARGET)
$(FORCE_REBUILD):
@echo rebuilding...
install: $(DESTDIR)/$(CRACKLIB_TARGET)
rebuild:
$(MAKE) $(MOREMAKEFLAGS) "FORCE_REBUILD=REBUILD"
clean:
$(RM) -f $(CRACKLIB_TARGET)
$(RM) -f $(CRACKLIB_OBJS)
$(RM) -f #*
$(RM) -f *~
now run gmake
and gmake install
edit /etc/pam.conf as follows
95 #
96 other password required pam_dhkeys.so.1
97 other password requisite pam_authtok_get.so.1
98 other password requisite pam_cracklib.so
99 other password requisite pam_authtok_check.so.1
100 other password required pam_authtok_store.so.1
101 #
102 # Support for Kerberos V5 authentication and example configurations can
103 # be found in the pam_krb5(5) man page under the "EXAMPLES" section.
104 #
this is adding line 98 and save the file
thats it
regards peter