Pluggable Authentication Modules

Solar Designer | 8 Jun 2002 01:12

Re: pam_passwdqc wordlist .vs. cracklib word list

On Fri, Jun 07, 2002 at 05:30:51PM +1000, John Warburton wrote:
> I have been looking at PAM modules to ensure good passwords. Currently we
> use cracklib with PAM & a huge dictionary.
> 
> I have looked around & seen Solar Designer's pam_passwdqc as a drop in
> replacement. I have seen comments on the list saying that it will replace
> cracklib.
> 
> My question is that cracklib has a huge dictionary & I can add to it. But,
> pam_passwdqc has a small dictionary in wordset_4k.c (it doesn't even have
> the word "snoopy"  I don't feel as safe with pam_passwdqc as it has a
> small dictionary, yet Solar Designer really has it in for libcrack, and I
> respect Solar Designer's opinion. The function is_word_based() in
> passwdqc_check.c states that the dictionary check is not very important -
> how true is that?
> 
> Can anyone shed any light on my quandary?

I'm not sure you wanted to hear my opinion again, but I may try to
explain why I think the wordlist check in pam_passwdqc is of little
importance.  The "small dictionary" you're referring to is in fact
primarily used for generating random passphrases (one of the features
of pam_passwdqc) and, yes, is also used for a wordlist check.  Just
because it's there anyway.

Basically, if you allow short passwords (and not just passphrases),
you have to insist that a sufficient number of different characters
from several different character classes are used.  That is regardless
of whether the password is based on a dictionary word or not.  Even if
it is not word-based, it shouldn't fall into a common sub-keyspace

(Continue reading)

headers

Jenn Vesperman | 8 Jun 2002 20:13

Re: pam_passwdqc wordlist .vs. cracklib word list


> On Fri, Jun 07, 2002 at 05:30:51PM +1000, John Warburton wrote:

> > My question is that cracklib has a huge dictionary & I can add to it. But,
> > pam_passwdqc has a small dictionary in wordset_4k.c (it doesn't even have
> > the word "snoopy"  I don't feel as safe with pam_passwdqc as it has a
> > small dictionary, yet Solar Designer really has it in for libcrack, and I
> > respect Solar Designer's opinion. 

Why not use both? Stack them. Make the users pass both systems.

Jenn V.
--

-- 
    "Do you ever wonder if there's a whole section of geek culture 
        	you miss out on by being a geek?" - Dancer.

jenn <at> anthill.echidna.id.au     http://anthill.echidna.id.au/~jenn/

headers

Solar Designer | 9 Jun 2002 05:32

Re: pam_passwdqc wordlist .vs. cracklib word list

On Sun, Jun 09, 2002 at 04:13:52AM +1000, Jenn Vesperman wrote:
> > On Fri, Jun 07, 2002 at 05:30:51PM +1000, John Warburton wrote:
> 
> > > My question is that cracklib has a huge dictionary & I can add to it. But,
> > > pam_passwdqc has a small dictionary in wordset_4k.c (it doesn't even have
> > > the word "snoopy"  I don't feel as safe with pam_passwdqc as it has a
> > > small dictionary, yet Solar Designer really has it in for libcrack, and I
> > > respect Solar Designer's opinion. 
> 
> Why not use both? Stack them. Make the users pass both systems.

It's not such a good idea because:

1. One of the features of pam_passwdqc is its support for passphrases.
They may contain dictionary words, yet be strong enough.  Also using
CrackLib would defeat that.

2. Both pam_passwdqc and pam_cracklib support user interaction.  In
order to stack both modules, you'd have to disable user interaction in
one (which, at least for the case of pam_passwdqc, is supported).  The
disadvantage is that by doing so you disallow having multiple attempts
to enter a new password which would satisfy the module for which user
interaction has been disabled.  If a weak password is entered (by that
module's definition), pam_chauthtok() will immediately return failure.

--

-- 
/sd