Password and Login Policies¶

The same policies you set in Windows Local Security Policy exist on Linux. They're just spread across a few text files instead of one console.

Password aging: /etc/login.defs¶

Controls how long passwords last for accounts created from now on.

sudo gedit /etc/login.defs

Press Ctrl+F and search for PASS_MAX_DAYS. Set these three lines:

PASS_MAX_DAYS   90
PASS_MIN_DAYS   1
PASS_WARN_AGE   7

Setting	Meaning	Windows equivalent
`PASS_MAX_DAYS`	Days before a password must be changed	Maximum password age
`PASS_MIN_DAYS`	Days a user must wait before changing it again	Minimum password age
`PASS_WARN_AGE`	Days of warning before it expires	(none)

Save and close. These apply to new accounts. For accounts that already exist, use chage:

sudo chage -M 90 -m 1 -W 7 alice     # set for one user
sudo chage -l alice                  # show a user's current settings

Password complexity: pam_pwquality¶

Length and complexity rules come from the pam_pwquality module. Install it if it isn't there:

sudo apt install libpam-pwquality

Then edit /etc/security/pwquality.conf and uncomment or add:

minlen = 10
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1

minlen is the minimum length. Each -1 requires at least one of that class: digit, uppercase, lowercase, other (symbol). This is the Linux version of "password must meet complexity requirements."

Password history (the Windows "enforce password history" setting) is set in /etc/pam.d/common-password by adding remember=5 to the pam_unix.so line.

Account lockout: pam_faillock¶

Lockout after failed logins uses pam_faillock. On Ubuntu the clean way to turn it on is with pam-auth-update profiles.

Create the first profile:

sudo touch /usr/share/pam-configs/faillock
sudo gedit /usr/share/pam-configs/faillock

Put this in it:

Name: Enforce failed login attempt counter
Default: no
Priority: 0
Auth-Type: Primary
Auth:
    [default=die]   pam_faillock.so authfail
    sufficient      pam_faillock.so authsucc

Create the second:

sudo touch /usr/share/pam-configs/faillock_notify
sudo gedit /usr/share/pam-configs/faillock_notify

Name: Notify on failed login attempts
Default: no
Priority: 1024
Auth-Type: Primary
Auth:
    requisite   pam_faillock.so preauth

Enable both:

sudo pam-auth-update

Use the arrow keys and spacebar to tick Notify on failed login attempts and Enforce failed login attempt counter, then select Ok.

The threshold and lockout time are in /etc/security/faillock.conf:

deny = 5
unlock_time = 1800
fail_interval = 900

That's five failures, locked for 30 minutes, counting failures within a 15-minute window. Same numbers as the Windows lockout policy.

Warning

PAM controls whether anyone can log in at all. A typo can lock you out of the machine. Keep a root shell open in another terminal while you test, and make sure you can still log in before closing it.

What PAM is¶

PAM (Pluggable Authentication Modules) is the framework Linux uses for login. Each program that authenticates users (login, sshd, sudo, the desktop login screen) reads a file in /etc/pam.d/ that lists the modules to run and in what order. pam_unix checks the password, pam_pwquality checks its strength, pam_faillock counts failures. pam-auth-update writes the shared common-* files so you don't have to edit them by hand.

Try it¶

Set the three login.defs values and confirm with grep ^PASS_ /etc/login.defs.
Run sudo chage -l on your own account. What is the current maximum?
Install libpam-pwquality, set minlen = 10, then try passwd with a short password and read the error.

Next¶

Updates, Firewall, and Services