Hardening Linux Passwords with pam_cracklib and pam_pwquality
Weak passwords remain one of the most common vectors for initial access and lateral movement in enterprise Linux environments. By default, many Linux distributions enforce minimal password complexity rules. The pam_cracklib module (and its modern successor pam_pwquality) provides password strength checks by testing proposed passwords against dictionary wordlists, entropy requirements, and complexity rules. Key Configuration Parameters Understanding the parameter syntax: Positive credits (e.g., dcredit=1): Bonus characters that reduce the required total length. Negative credits (e.g., dcredit=-1): Strict minimum requirements (must contain at least that number of characters). Parameter Function Recommended Setting minlen=12 Minimum total characters required 12 or higher dcredit=-1 Minimum number of digits required -1 ucredit=-1 Minimum uppercase characters required -1 lcredit=-1 Minimum lowercase characters required -1 ocredit=-1 Minimum special/punctuation symbols required -1 maxrepeat=2 Maximum consecutive repeated characters 2 reject_username Forbids passwords containing the username Included enforce_for_root Enforces the policy on the root account Crucial dictpath=<path> Custom wordlist path for dictionary checks e.g., /usr/share/dict/words Step 1: Configuring PAM Password Policy In Red Hat, CentOS, and Debian/Ubuntu derivatives, password policies are typically applied in /etc/pam.d/system-auth (RHEL/CentOS) or /etc/pam.d/common-password (Debian/Ubuntu): ...