Home / server / Questions / 255322
In Process
Dom
Asked: 2011-04-05 00:48:51 +0800 CST

PAM : Reject the standard password

  • 772

I want to reject our standard password in pam for the services until the user change it. It is a fixed password, well known by our users, but I don't know how I can configure pam to refuse it. I check cracklib, but it works only on password change, not on auth. I can't use pam_succeed_if as it doesn't check the password.

Any idea how reject this password ?

password pam

2 Answers

  1. chage -d 0 username should do it. You might have to set a null initial password which probably isn't very secure but some trial and error testing should reveal if that's the case.

    -edit-

    In that case can you spawn a login script upon login using /etc/profile, /etc/bash.bashrc or similar to set that password first and then let them ageing policy force it to be changed ?

    • 2

  2. Consider pam_exec

    • 2