Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wanted to set a password restriction policy , like minlen , maxage , minage etc .

I know the way to do it system wide ,

Can we do it for a particular group of users . I mean only users under group of admin should compile with these restriction , and other users should compile these restrictions..

share|improve this question
    
slight correction .. – Amit Singh Jul 4 '13 at 16:52
    
other users should not compile these restrictions.. – Amit Singh Jul 4 '13 at 16:56

You say that you know how to enforce a password policy system-wide, but I'll reiterate what to do for anyone who doesn't. You can use a PAM module, pam_cracklib.so, that checks to make sure a password meets certain criteria before allowing the password to be applied to an account. In Ubuntu, the package libpam-cracklib installs this module, and applies the following line to the top of /etc/pam.d/common-password, the file that deals with changing a user's password:

password    requisite           pam_cracklib.so retry=3 minlen=8 difok=3

Various options can be passed to pam_cracklib.so, and in this case a minimum length of 8 is specified with a requirement of 3 character changes from the old password. See http://linux.die.net/man/8/pam_cracklib for a detailed list of every option available.

To limit one policy for a certain group of users, it is possible to utilise the pam_succeed_if.so module, that only succeeds if a user matches various criteria. For example, to enforce a password policy like the one above, but leaving users in the 'sudo' group exempt, use:

password    [success=1 default=ignore]  pam_succeed_if.so user ingroup sudo
password    requisite           pam_cracklib.so retry=3 minlen=8 difok=3

This tells PAM to check if the user matches group 'sudo', then skip the next module if that succeeds. Otherwise, continue on with the next module, which enforces a password policy.

However, if using a PAM module with the option use_authtok like the default Ubuntu pam_unix.so configuration with pam_cracklib.so installed, this will not work quite right. Since pam_unix.so depends on a module previously to have set the current user password and desired password, should the pam_succeed_if.so module succeed then passwd will error out with passwd: Authentication token manipulation error. The way I got around it was to use a second pam_unix.so line:

password    [success=2 default=ignore]  pam_succeed_if.so user ingroup sudo
password    requisite           pam_cracklib.so retry=3 minlen=8 difok=3
password    [success=2 default=ignore]  pam_unix.so obscure use_authtok try_first_pass sha512
password    [success=1 default=ignore]  pam_unix.so obscure sha512

In this example, should the user be in group 'sudo', control skips 2 modules down to the final pam_unix.so line which does not include use_authtok. Should it fail however, control passes to pam_cracklib.so, then to the dependent pam_unix.so

share|improve this answer
    
Great Help sir , I worked .. – Amit Singh Jul 18 '13 at 9:58
    
I have 1 more query , I want that whenever user run passwd command it should display some banner like minimum length required =8 etc.. – Amit Singh Jul 18 '13 at 14:01
    
For this you can use pam_echo.so a module that simply echoes out a message. For example, to echo out the contents of a file that details what a good password is, use password optional pam_echo.so file=/usr/share/doc/good-password.txt, putting that line before any others in common-password. – Xenopathic Jul 19 '13 at 10:37
    
Also, if the answer above worked for you, please don't forget to mark it as accepted – Xenopathic Jul 19 '13 at 10:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .