2

Is there a way I can get information on the password for a particular user like what is the minimum length and minalpha and etc.?

In AIX we have a command called lsuser:

lsuser -a minlen username 

That command will return the minimum length of a user’s password. Is there an equivalent command in Linux?

I need this to find the users who have weak passwords, since even though I apply the restriction from pam, a user can change whatever password he want as root user.

I don’t have to apply the restriction for root.

4
  • 1
    Are you asking about how to find weak passwords or prevent them?
    – ethrbunny
    Nov 14, 2013 at 13:18
  • This sounds like you are administering a system for many users but questions about IT networks are off topic here. I recommend you flag this post for moderator attention and ask them to migrate to either Server Fault or Unix & Linux. This question will be on topic on both sites and you will also have a better chance of getting answers since that is where the professional *nix sysadmins hang out.
    – terdon
    Nov 14, 2013 at 13:40
  • 2
    According to the documentation of the shadow file the passwords are only stored as hashes. There is no way to know the length of the once saved passwords. You'd be better off enforcing a rule when users assign themselves new passwords (or get assigned).
    – Bobby
    Nov 14, 2013 at 13:51
  • Those attributes can be considered password policy and are not retroactive. They are not derived from the password.
    – Brian
    Nov 14, 2013 at 14:40

2 Answers 2

1

To my knowledge (20+) years, there is no method to do this in any variant of Linux. More importantly this just sounds like a bad idea from a security standpoint.

No meta information about the passwords should be kept around, since in the wrong hands, could completely reduce the cracking problem space from impossible to easy.

Think about it, you're a cracker that has either gained access to a Linux system, or has retrieved the /etc/shadow file, and you're now attempting to use a rainbow table to gain access to several of the accounts in this file.

Sure would be handy info to tell my algorithm to skip any entries in my table that don't match the minimum length or don't contain a minimum number of alpha characters, with respect to the hashed password we're attempting to identify.

Incidentally, most of the methods I've seen employed at Fortune 500 companies that I've worked at would include using a cracking tool such as John the Ripper, or something similar, to attempt to break into the accounts as part of any auditing activities.

1

I don't think there is a command that pulls things together as on AIX.

http://www.itworld.com/endpoint-security/275056/how-enforce-password-complexity-linux
How to enforce password complexity on Linux
see /etc/login.defs

My machine (Fedora release 19) has

# PASS_MIN_LEN    Minimum acceptable password length.
PASS_MIN_LEN    5
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .