Find the answer to your Linux question:
Results 1 to 6 of 6
Ī'm still somewhat new, but I have a question based on an observation I just saw. I just tried to cha˝ge my password for a user in centos. It kept ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Aug 2013
    Posts
    2

    password


    Ī'm still somewhat new, but I have a question based on an observation I just saw. I just tried to cha˝ge my password for a user in centos. It kept telling me that the old and new passwords were similiar/the same. But the only similarity was that the old and new had 8 characters. First 4 were letters, the first being capital. Last 4 characters were numbers. Actually the 5th and 6th character were the same numbers in both passwords come to think of it. Anyways, I thought it was interesting on security. But am i right in assuming Linux doesnt allow ANY character to be the same or it doesnt like the same character pattern ?
    Also, is there a way to customize password security for you or your own business needs? (including expiry, etc)

  2. #2
    Just Joined!
    Join Date
    Feb 2012
    Posts
    12
    For account expiration, you can use the chage command(see man chage for details). You need to run that command as root.
    As to the password thing, I tried the same thing in my CentOS box, and got the following message:
    Code:
    BAD PASSWORD: is too similar to the old one
    Then tried a very basic password (1234):
    Code:
    BAD PASSWORD: it is based on a dictionary word
    This seems to be a CentOS thing though, because Debian allows that pattern when you change passwords.
    Here's a link on password security in CentOS: centos.org/docs/4/html/rhel-sg-en-4/s1-wstation-pass.html
    It may be useful for you.
    Good luck and let us know if you need further help.

  3. #3
    Linux Enthusiast TNFrank's Avatar
    Join Date
    Jul 2013
    Location
    Crossville, TN. USA
    Posts
    548
    Personally, I'd use a Pass Phrase instead of just a Pass word. A Pass Phrase, like "IhateWindows234" or the like would be harder to crack and easy to remember then just a single word. Also, you get caps, lower case and numbers all in the phrase so there's very little chance of someone hacking it with an automated password cracker.

  4. #4
    Linux Guru
    Join Date
    Oct 2007
    Location
    Tucson AZ
    Posts
    3,110
    I've never used CentOS but have seen similar messages when creating a password but it didn't prevent me from using it. Another thing that makes for more secure passwords is using special characters such as ! or ?, placing them where they wouldn't be expected.

  5. #5
    Just Joined!
    Join Date
    Aug 2013
    Posts
    2

    password

    Quote Originally Posted by yancek View Post
    I've never used CentOS but have seen similar messages when creating a password but it didn't prevent me from using it. Another thing that makes for more secure passwords is using special characters such as ! or ?, placing them where they wouldn't be expected.
    Right. We used to do that at work. @ for a and 3 for e or ! for 1.
    I haven't done too much on the hacking side except getting hash values from windows passwords (my own password not someone else's lol). As for using a similiar password on centos, it wouldn't let me. It made me do a new password and if I kept making it too similiar it would prompt again. It did this 3 times and then said it failed.
    I've still got to look up specifics on password security but I will have more time today. Since Debian does not have this, I'm wondering if this is a Redhat thing as well since Centos is a variation of Redhat I believe.

  6. #6
    Just Joined!
    Join Date
    Aug 2008
    Posts
    1
    Quote Originally Posted by dragonix View Post
    Right. We used to do that at work. @ for a and 3 for e or ! for 1.
    I haven't done too much on the hacking side except getting hash values from windows passwords (my own password not someone else's lol). As for using a similiar password on centos, it wouldn't let me. It made me do a new password and if I kept making it too similiar it would prompt again. It did this 3 times and then said it failed.
    I've still got to look up specifics on password security but I will have more time today. Since Debian does not have this, I'm wondering if this is a Redhat thing as well since Centos is a variation of Redhat I believe.
    The similarity restriction is set through PAM modules. Both pam_cracklib and pam_passwdqc can enforce similarity restrictions.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •