search for: cracklib

...bedit -P "maximum password age" -C 90 These items appear to work with no difficulty. However this does not address the dictionary/complexity requirement. I have seen the following suggestion elsewhere on the samba list: check password script = /usr/local/sbin/crackcheck -d /var/cache/cracklib/cracklib_dict I am not able to use this suggestion directly. No file "crackcheck" is present on my system. There is a /usr/sbin/cracklib-check but it seems to work on a file or stream, like grep or something, as opposed to returning a value as a function. And it does not seem to accep...

Hello, I would like to enforce some level of password complexity when users change their password. I have a Samba PDC running on Debian set to sync Unix passwords. I'm trying to get Samba to work with cracklib, but it isn't going well. Here is what I've tried: Installed libpam-cracklib, compiled examples/auth/crackcheck and copied the binary to /usr/local/sbin. I added the following line to my smb.conf file: check password script = /usr/local/sbin/crackcheck Edited /etc/pam.d/common-passwo...

I'm testing Samba 3.0.3pre2 and am particularly interested in the new --with-cracklib support. I see the configuration directive to enable cracklib functionality in the changelog, but am curious if anyone has any additional documentation. The man pages, etc... appear not to be updated yet. Is there any mechanism for 'tweaking' the password strenth rules, as there is with...

Hi Samba folks, I had a couple questions about password complexity checking. To preface, in smb.conf, we set: check password script = /usr/local/sbin/crackcheck -d /usr/share/cracklib/pw_dict Also, if I understand correctly: /usr/local/sbin/crackcheck comes from samba source rpm package. maybe we need to compile it ourselves. /usr/share/cracklib/pw_dict* comes from cracklib-dicts rpm package Here are my questions: 1) may we also specify -c along with -d in check password sc...

Hi! I've wrote to you on previous occasion but surprisingly nobody seems to have this problem, I don't know if it can be an error mine in the configuration files or if it's a problem in the Samba with cracklib, well I've installed samba 3.0.4 and put in the file /etc/pam.d/samba an entry to the cracklib library but smbd seems to do nothing with this line, I've devel cracklib's libraries installed and my cracklib works properly with the system accounts. I hope you tell me some idea because...

...Downloading headers to solve dependencies... ####################################### Downloading headers to solve dependencies... ######################################## audit-libs-1.0.15-3.el4_6.1 ########################## Done. audit-libs-1.0.15-3.el4_6.1 ########################## Done. cracklib-2.8.9-1.3.i386.rpm ########################## Done. cracklib-2.8.9-1.3.i386.rpm ########################## Done. glib2-2.4.7-1.i386.rpm: ########################## Done. glib2-2.4.7-1.i386.rpm: ########################## Done. pam-0.77-66.23.i386.rpm: ########################## Done....

.... (any advice is good advice) I have a 3.0.14a-debian samba install, with ldap auth using pam_unix (see smb.conf below) We want to implement a few password checks for complexity, so I have written a pretty basic script (see below) which definitely exits 0 on a good password and throws it at cracklib (after complexity checks) to check for dictionary words. pdc:~/scripts# ./cracklib.sh repasdateA! pdc:~/scripts# echo $? 0 pdc:~/scripts# ./cracklib.sh r3pl1Cat3 ERR - it is based on a dictionary word pdc:~/scripts# echo $? 253 When I add it into smb.conf, it doesn't work. All use...

...line by line -- alex] Last night I sent to redhat-list a letter with a patch. After sleeping a little I found that my patch is not enough correct. Now I post the new patch and description of the problem. In redhat distribution passwd program uses PAM, namely, pam_unix_passwd.so. This module use cracklib to check password for satisfying several conditions. I found a bug in cracklib which can cause passwd to perform accesses to random addresses in the task memory. This potentially can cause a security problem (and passwd of course doesn''t change password after performing random accesses)....

Package: logcheck-database Severity: wishlist Tags: patch Please consider applying the attached patch. Logcheck doesn't match lines like the following right now: ---- Jan 26 04:26:29 space-based cracklib: updated dictionary (read/written words: ). ---- /Armin -- System Information: Debian Release: 4.0 APT prefers unstable APT policy: (500, 'unstable'), (500, 'testing'), (1, 'experimental') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/dash Kernel: Linux 2.6....

...The ldap also contains the posix information for the users to login to some web/mail/etc. servers. I'm faced with the task to implement a 'both worlds' compatible paswword sync process regarding complexity etc. For the posix account password we use a webfrontend, configure to use pam/cracklib checks which works fine. E.g. 'hello' is NOT allowed as password :-) Checking the password change from a windows 7 / XP notebook reveals, that there is not such a complexity check used. E.g. 'hello' IS allowed as a users password. :-( Password syncing (posix <-> windows) wor...

>No. ssh-keygen should never be pamifed. It is worthless to do so. > >If we are going to enforce passphrase quality it should be for all OSes. >The world does not revolve around Linux. No matter what the press may >think. The Linux community didn't invent PAM, Sun did. Many more systems than Linux have PAM, Solaris, HP-UX some BSDs for a start. Having said that I agree with

Hi! before nothing, sorry for my english, I hope you understand me. I've a problem with the new samba 3.0.4-1.12, before I had the version 3.0.2a with LDAP for administrate all the users and when a samba password expired I used the "use cracklib" parameter for force the user to insert a strong password, well now this parameter isn't avaliable and I believe that must make it with the /etc/pam.d/samba file if I want to do the same effect than before, but the line which references to the pam_cracklib.so seems to do nothing and I c...

...iles.in b/appliance/excludefiles.in index 1564386..d3c66cc 100644 --- a/appliance/excludefiles.in +++ b/appliance/excludefiles.in @@ -23,13 +23,15 @@ dnl The right kernel modules are added back by supermin. -/lib/modules/* -/usr/lib/locale/* --/usr/share/locale/* --/usr/share/man/* +-/usr/share/cracklib/* -/usr/share/doc/* --/usr/share/info/* +-/usr/share/fonts/* -/usr/share/gnome/help/* --/usr/share/cracklib/* -/usr/share/i18n/* +-/usr/share/icons/* +-/usr/share/info/* +-/usr/share/locale/* +-/usr/share/man/* -/usr/share/pkgconfig/* -/var/log/?tmp -- 2.4.3

...g the password complexity in samba? I have tried the next one 1. Download and extract samba-3.4.15.tar.zg. Go to samba-3.4.15/examples/auth/crackcheck and compile crackcheck 2. Copy crackcheck binary to the /usr/bin/ 3. Check that the program working correctly # /usr/bin/crackcheck -d /usr/share/cracklib/pw_dict 123 ERR - it is too short # /usr/bin/crackcheck -d /usr/share/cracklib/pw_dict AV7OaV2BRr Looks good. 4. Add the following line to the smb.conf and restart samba check password script = /usr/bin/crackcheck -d /usr/share/cracklib/pw_dict But when I change user password from command line...

I would like to bump my question 2015-05-27 10:21 GMT+03:00 Krutskikh Ivan <stein.hak at gmail.com>: > Hmm, looks like it's not. I've just set the password for something that > cracklib-check would argue using both ad management tools and at windows > login. Should it work that way or I'm missing something? > > My dc's smb.conf: > > [global] > workgroup = KURSK > realm = KURSK.MTT > netbios name = DEBIAN-DC > serv...

I have Samba PDC with an LDAP backend. I just realized that the users can reset their passwords to anything, a single character a space. Is there anyway to prevent this?

...re were modifications to be done using pdbedit so as to set the next time the password must be changed. I've tryed on my account, it doesn't work as I expected it to do : the password is valid for the time passed as an argument, and that's not what I want. Next, I've read about a cracklib-checker that can be called via the smb.conf file, but I don't have this cracklib-checker installed on my system, and I don't really know where to find it. Thanks in advance for any help provided. P.S. I've searched the docs on samba.org, but I haven't found anything relevant, a...

Hi everyone, A quick question: Is check password script option working for ad dc setup? I believe, ad on it's own cannot provide password protection against dictionaries.

...h the samba 4.1X packages installed. Our AD is a Windows AD. I have succeeded in getting wbinfo -u to return domain users, wbinfo -g to return domain groups, getent passwd to return domain users in passwd form, getent group returns domain groups.. I have made certain that libnss-winbind, libpam-cracklib and libpam-winbind are installed. They all seem to be ii libpam-cap:amd64 1:2.24-0ubuntu2 amd64 PAM module for implementing capabilities ii libpam-cracklib:amd64 1.1.8-1ubuntu2 amd64 PAM module to enable cracklib support ii libpam-modules:amd64...

...make && \ make install By then I install a dummy Bind9.9, i.e. without the AD related zones. Next I install sssd and configure PAM. apt-get install sssd sssd-tools libnss-sss libpam-sss libsss-sudo \ libsasl2-modules-gssapi-mit ldap-utils python-sss libsasl2-modules-ldap \ cracklib-runtime libsss-nss-idmap0 I do fix the sssd and krb5.conf files here, even though it won't work until samba is compiled and running. apt-get install sssd sssd-tools libnss-sss libpam-sss libsss-sudo \ libsasl2-modules-gssapi-mit ldap-utils python-sss libsasl2-modules-ldap \ crac...