password policy rule enforcement using PAM

Hi Andrew,
According to the docs for pam_cracklib, 6.3 Cracklib pluggable password strength-checker, libcrack and a system dictionary are required. I think there's a dictionary in /usr/share/cracklib but I don't believe that libcrack is installed by default on the OS X client (I don't know about the server) so I wouldn't expect that module to be available. Furthermore, there's no pam_cracklib.so in /usr/lib/pam so I don't think it's going to be available to you unless you install the requirements and compile it yourself. For what it's worth, I think that I compiled libcrack once so compiling the module is not beyond the pale.

There also appears to be a crack dictionary in the resources of the SecurityInterface.framework. Thus, this may be something that Apple does internally, although I've seen no evidence of it.
--
Gary
~~~~
lighthouse, n.:
A tall building on the seashore in which the government
maintains a lamp and the friend of a politician.

I don't know if this will meet your needs, but another approach might be to try configuring "NetInfo" and enabling enforcement of "password policy" from there. There don't seem to be a whole lot of options, but keys such as ' requiresNumeric' (password must contain at least one number), ' requiresAlpha' (at least one letter), or ' minChars' (minimum length), plus a few that disable the account (eg. after a number of failed tries, or on a set date) seem to be at least partially functional based on some limited tinkering. I didn't see any options for forcing a requirement for "case" or symbols though. The rules can be set on a "per-user" basis, or globally, with the caveat that they won't apply to "admin" users.

This is where I heard about ' pwpolicy':
http://www.afp548.com/article.php?story=20040926173146494

There is also a ' man' page here:
man pwpolicy.

Strange, that pam_cracklib doesn't come on OS X. Since the source code is here:


http://www.opensource.apple.com/darwinsource/10.4.5.ppc/pam-14/pam/modules/pam_c racklib/

Go figure.

there may be more, but the only ones that I found are under /usr/lib/pam

pam_afpmount.so pam_nologin.so pam_securetty.so pam_uwtmp.so
pam_deny.so pam_permit.so pam_securityserver.so pam_wheel.so
pam_netinfo.so pam_rootok.so pam_unix.so

Message was edited by: Nils C. Anderson