9

I have an Ubuntu GNOME 15.10 with GNOME 3.18 system which I would like to set up so that the users using it cannot set a new password as one of the previous X passwords, how can this be achieved?

When I change my password, if it is too similar to my last my system does not allow me to change it to that password, it would be good if the answer could also show how to extend this so that the new password can also not be too similar to the previous X recorded passwords.

Note: The history of the last X passwords should not be stored in an insecure unencrypted manner, in fact they should probably be stored in the same or similar way to the way in which the current password is stored (as a salted hash).

I have used X to represent the number of passwords (this could be any value) because I want to be able to easily change the amount of passwords stored which cannot be used, and also so that others can easily take the answer and use it as they wish rather than having an answer which revolves around a very set value for X.

Information Update:

As requested here is the contents of my (excluding the comments at the top) /etc/pam.d/common-password file:

# here are the per-package modules (the "Primary" block)
password        [success=1 default=ignore]      pam_unix.so obscure sha512
# here's the fallback if no module succeeds
password        requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password        required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
password        optional        pam_gnome_keyring.so
# end of pam-auth-update config
5
  • Note that a) forcing users to change their password and b) preventing X old passwords where X is > 2 can reduce security... "Hmm better just append 1 to my old password... And write it on the postit note to remind me..."
    – Tim
    Apr 7, 2016 at 20:10
  • @Tim: There are already mechanisms built into my system which prevent the password being too similar to the last.
    – user364819
    Apr 7, 2016 at 20:13
  • That is often just as bad - that ensures the user will write it down. I'm also unconvinced changing it has any benefits - and it certainly has negatives.
    – Tim
    Apr 7, 2016 at 20:14
  • @Tim: Also, you just reminded me of something I forgot to include, I have updated my question with it (though note that although this would be nice, if the answer cannot show how to do this additional thing then I would be fine with getting what I originally asked for).
    – user364819
    Apr 7, 2016 at 20:16
  • @Tim: I will have other policies in place preventing them from doing that and will be keeping a close eye on them.
    – user364819
    Apr 7, 2016 at 20:17

1 Answer 1

17

You can configure PAM to do this for you. Just open /etc/pam.d/common-password and append use_authtok to the first password line (the one which calls the pam_unix module) so that it looks somewhat like this:

password    [success=1 default=ignore]  pam_unix.so obscure sha512 use_authtok

Now add this line above the previously modified line:

password    required    pam_pwhistory.so  remember=X

where X is the number of previous passwords against which you want to check for a repeating password.

Here the previous X passwords will be stored in hashed form at the location /etc/security/opasswd

So you need to create the file if and only if it does not exist and assign it permission 600 (-rw-------):

sudo touch /etc/security/opasswd
sudo chmod 600 /etc/security/opasswd
8
  • Though doing as you say does seem to mean that if I try to set a password I have used before as one of my last X passwords in the gnome-control-center it just does nothing and forces me to force quit the application, it doesn't seem to work very well... What exactly does it do on 14.04? Because I would expect it to indicate to me if the password was not suitable instead of just hanging when I ask it to change it.
    – user364819
    Apr 8, 2016 at 11:48
  • @ParanoidPanda Very interesting. What do you get when you try to change the password using passwd? This is what happens to me. When I change using passwd I get "Password has been already used. Choose another." and when I try to change password from the GUI it does not allow me to change the password (Change button is greyed out) and "Password too weak" is written. Apr 8, 2016 at 13:11
  • It should be noted that I am reporting from Ubuntu 14.04 running Unity, not Gnome. Apr 8, 2016 at 13:12
  • I have tested it again, this time in an installation of Ubuntu GNOME 16.04 Beta 2 with GNOME 3.20 and I have found that it works the same as you have described with the passwd command, but not in the gnome-control-center, there it just hangs after it allows me to press Change. Though maybe this is a bug I need to file a report on...
    – user364819
    Apr 8, 2016 at 15:18
  • 2
    @ParanoidPanda This would be because of lousy programming in gnome-control-center, not because this doesn't work. PAM configuration is definitely the best way to do this.
    – Seth
    Apr 12, 2016 at 21:47

You must log in to answer this question.