Forcing Stronger Passwords

[nebraska57]

Hello, All...

OK, I think I'm so close to having an answer to this, but can't seem to make the final step. I'm cracking down on the lame passwords people have been selecting and I know I can achieve that through PAM and via /etc/pam.conf -- but for the life of me I can't figure out how to get it done.

I know it has to have something to do with an extended Password Management module that forces something like a dictionary check, but I'm at a loss at this point. We're mostly Solaris 8 with a few 9 installations and a few legacy 2.6 systems.

Right now, the default config forces a password of at least 6 characters and at least one numeric or special character... But that's not enough as someone could still get away with their first or last name and just add a number to it -- which John the Ripper gets in about 5 seconds!

Can anyone help with some advice on how to further strengthen my systems' password checking?

Many thanks in advance.

James

 

[tikual]

take a look.

http://www.openwall.com/passwords/unix.shtml

tikual

 

[nebraska57]

Thanks for the response, but I was hoping to find something more proactive -- such as a mechanism that rejects bad passwords when users pick them. I'm already doing password cracking after the fact and am actually trying to get away from that. It just seems incredibly hard to believe that the best Solaris can do is the rudimentary (and ineffective) checks done by default through PAM.

But thanks again for answering.

 

[tikual]

One more page may be worst for you.

http://www.gnu.org/directory/security/auth/

tikual