Enforce password security through pam
Add suitable pam modules in place which will enforce
password security
1. pam_cracklib is added with minimum length of 8. Length
greater than 8 can be configured through D-Bus interface.
2. pam_pwhistory is added to remember old password. Disabled
by default. Can be enabled through D-Bus interface
3. pam-tally2 used to lock out account after failed attempts.
Disabled by deault. Can be enabled through D-Bus interface
Note: pam_cracklib will do password verification one extra time,
hence with this fix, any password change will request,
Retype new password for 2 times.
(From meta-phosphor rev: bb70abc065a7eeb3206460ad20041bc132dab784)
Change-Id: Ibc5e275196509fb0b47c7174805195475d66590c
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
diff --git a/meta-phosphor/recipes-core/pam/libpam/pam.d/common-password b/meta-phosphor/recipes-core/pam/libpam/pam.d/common-password
new file mode 100644
index 0000000..ddd7ca1
--- /dev/null
+++ b/meta-phosphor/recipes-core/pam/libpam/pam.d/common-password
@@ -0,0 +1,28 @@
+#
+# /etc/pam.d/common-password - password-related modules common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of modules that define the services to be
+# used to change user passwords. The default is pam_unix.
+
+# Explanation of pam_unix options:
+#
+# The "sha512" option enables salted SHA512 passwords. Without this option,
+# the default is Unix crypt. Prior releases used the option "md5".
+#
+# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
+# login.defs.
+#
+# See the pam_unix manpage for other options.
+
+# here are the per-package modules (the "Primary" block)
+password [success=ok default=die] pam_cracklib.so debug enforce_for_root reject_username minlen=8 difok=0
+#password [success=ok ignore=ignore default=die] pam_pwhistory.so debug enforce_for_root remember=0 use_authtok
+password [success=1 default=die] pam_unix.so sha512 use_authtok
+# here's the fallback if no module succeeds
+password requisite pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+password required pam_permit.so
+# and here are more per-package modules (the "Additional" block)