Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

On UNIX or Windows plateforms, is it possible to force passwords not to contain a pattern or dictionary word?

For example, could this password be automatically rejected on Windows 2008: Abc1Abc1AbcHome

share|improve this question

migrated from security.stackexchange.com Sep 24 '13 at 20:32

This question came from our site for Information security professionals.

    
Yes, it's possible. deer-run.com/~hal/sysadmin/pam_cracklib.html –  Adnan Sep 23 '13 at 18:03
2  
@lisa17 - Why would you force this on your users? ARANDOMWORDPHRASETHATCOMBINESEASYTOREMEMBERWORDSISABETTERPASSPHRASE then SDjkdjfkjadkfjdfdjkfdjfkdjkfjdsfj234234 one could argue that a password generator that combines 6+ random dictionary words would be harder to crack then a password of equal character length. –  Ramhound Sep 24 '13 at 15:56
2  
Whether it's possible or not, it's a terrible idea. So you would reject all passwords containing the letter a, since a is a dictionary word? –  Gilles Sep 24 '13 at 20:34
2  
If you use complex and random passwords you will just move the password out of a persons head and onto a sticky note on the monitor. Encouraging pass-phrases, as @Ramhound states, is a better solution. –  Bill Sep 24 '13 at 20:44
add comment

3 Answers

I believe this is possible in windows by tweaking the registry to use a custom password filter dll. The articles below should get you started:

share|improve this answer
add comment

It definitely can be done on Linux using pam_cracklib:

openSUSE installer detecting weak password using pam_cracklib

share|improve this answer
    
The screenshot suggest that dictionary words can be checked within the password, but what about patterns (ie WordWordWord)? –  lisa17 Sep 27 '13 at 11:56
1  
@lisa17, yes, but indirectly by determining the number of different characters. i.stack.imgur.com/woF7w.png –  DragonLord Sep 27 '13 at 14:10
add comment

In a lot of companies, who uses mainframes, this is done by using the mainframe RACF security for the windows login. On a stand alone PC, if You can change policies by twickUI or any other tools, it should be possible. I once did it almost impossible for me to create a password by using freshtwick and after 3.rd time of password change i removed that again :-).

We had i my old company rules said that these are not permitted: Single numbers in front or end, number of this year, prev year nor next year, numbers of this month, letters part of your username in any combinations, know personalty names, fictive names (EG Goofy is not permitted), known places (EG eifel, tai mahal), 3 equal printable chars in a row and repeated sequences. It discovered all this in English, German, Frensh, Swedish and Danish (we live in Denmark). And passwords could not be reused for 12 - 18 month. Additionaly it should contain both upper and lower cases, and number(s). I do not think it is wise to for a do like list, but more to do a don't use list.

People might think it uses a lot of time to check this, but no actually not, it consumes a lot of time to figure out Your next password.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.