View source for Slackware and cracklib

{{header_en|title=Tie Cracklib and Passwd in Slackware Linux| keyword={{Template:keyword_en_linux}}| description=A brief How-to guide to add Cracklib to the standard Slackware Linux authentication system | link_page=slackware_integrare_cracklib}}

== Introduction ==

In an [[using_cracklib | earlier article]] I introduced '''cracklib''' a '''small library of C functions aimed to check password strength against a dictionary based attack'''. '''Cracklib-check''', the command line tool performing the actual checks, was also presented in the article alongside some examples of its use. The tool is undoubtedly useful, but penalized by its design that favors its use by system administrators. Both library and check program are installed in folders dedicated to system administration that standard users cannot access directly and require recurring to the full path for each command. The check must be explicitly performed and that represents another risk factor. '''Nothing force users to check for password strength''' with cracklib therefore '''nothing really prevents setting a weak password''' even when the tool is installed and working correctly.

In this article I will discuss a way to '''integrate cracklib with the authentication subsystem of Slackware Linux''' in order to '''automate password checking''', forcing users to use the tool and improving the intrinsic safety of the system.

=== Tie Cracklib to the Slackware Linux Authentication System ===
There are '''two basic ways to tie cracklib to the authentication system of a Linux distribution''' depending whether [https://en.wikipedia.org/wiki/Pluggable_authentication_module PAM] is used or not. '''Slackware Linux does not include PAM packages''' among its official ones. This is a cautious choice by the group of developers of the distribution who do not consider the level of security guaranteed by PAM sufficiently high and therefore prefer to give up the flexibility offered by the tool modules favoring a system easier to run and configure.

'''To tie cracklib to the shadow password authentication system you'll have to rebuild the authentication package from source''' and install it replacing the standard one. For Slackware 14.2 the mentioned package is: '''shadow-4.2.1'''. Follow the next steps to enable cracklib:
* Build and install a recent cracklib package following the instructions included in an [[using_cracklib#Installing_Cracklib | earlier article]].

* Download the '''shadow password source code''' into a local directory for example ''/tmp'' or ''/usr/src/shadow-4.2.1''. The source code and build script for every Slackware Linux included package are available in the source code DVD, slackware-14.2-source-dvd.iso for example, or in the on-line source directory tree. Both can be downloaded from the net following links in the [http://www.slackware.com/getslack/ Slackware download page]. From the DVD root or the online file tree root directory, search for the source code in sub-directory ''source/a/shadow/''. The Slackware 14.2 directory should contain:
   [ ]   adduser                             13-Sep-2012 23:27    16K      Details
   [ ]   doinst.sh.gz                        28-Jan-2010 01:29    290      Details
   [ ]   login.defs.gz                       13-Sep-2012 23:27    4.5K     Details
   [DIR] patches/                            17-May-2013 02:19    -      
   [ ]   shadow-4.2.1.tar.xz                 09-May-2014 21:05    1.5M     Details
   [ ]   shadow-4.2.1.tar.xz.sig             09-May-2014 21:05    828      Details
   [ ]   shadow.CVE-2005-4890.relax.diff.gz  14-Dec-2013 21:05    734      Details
   [ ]   shadow.SlackBuild                   02-Jul-2014 00:21    5.1K     Details
   [ ]   shadow.url                          02-Jul-2014 00:15    46       Details
   [ ]   slack-desc                          30-Apr-2002 23:51    1.0K     Details
   [ ]   useradd.gz

* Download all of the files and sub-folders into the target directory of the local system then update the build script '''shadow.SlackBuild''' removing line:
<syntaxhighlight lang="bash">
   --without-libcrack \
</syntaxhighlight>

to replace it with:
<syntaxhighlight lang="bash">
   --with-libcrack \
</syntaxhighlight>

in order to enable cracklib feature support at compile time.

* Build the package with command:
   root@system # '''sh''' ./shadow.SlackBuild

then wait for the script to finish. A copy of the package will be saved into directory ''/tmp''.

* Update the package overwriting the installed one:
   root@system # '''upgradepkg''' ''--reinstall'' /tmp/shadow-4.2.1-i486-1.txz

The ''--reinstall'' option is mandatory otherwise the package will be ignored as it is already part of the system:
   root@system # '''upgradepkg''' shadow-4.2.1-i486-1.txz 
   
   +==============================================================================
   | <font color="red">Skipping package shadow-4.2.1-i486-1 (already installed)</font>
   +==============================================================================

* After installing you must '''configure dictionaries and enable their use with passwd'''. Dictionary configuration was part of an [[using_cracklib#Cracklib_and_Customized_Dictionaries | earlier article]]. Instructions to replace the standard dictionary, containing several thousand words, with the extended one containing approximately 2 millions words are summarized below. '''All commands should be run by root''' as they write system files and touch system directories.
   root@system # '''create-cracklib-dict''' /usr/share/cracklib/*
   skipping line: 1
   warning: input out of order: 'ghabcdefghabcdefghabcdefghabcd' should not follow 'habcdefghabcdefghabcdefghabcde' (line 55371)
   warning: input out of order: 'fghabcdefghabcdefghabcdefghabc' should not follow 'ghabcdefghabcdefghabcdefghabcd' (line 55372)
   warning: input out of order: 'efghabcdefghabcdefghabcdefghab' should not follow 'fghabcdefghabcdefghabcdefghabc' (line 55373)
   warning: input out of order: 'fghabcdefghabcdefghabcdefghabc' should not follow 'ghabcdefghabcdefghabcdefghabcd' (line 55375)
   warning: input out of order: 'abcdefghi' should not follow 'fghabcdefghabcdefghabcdefghabc' (line 55376)
   1911522 1911521
   root@system # '''ls''' ''-la'' /usr/share/cracklib/
   total 28252
   drwxr-xr-x   2 root root     4096 Dec  9 18:46 .
   drwxr-xr-x 214 root root     4096 Dec  9 20:02 ..
   -rw-r--r--   1 root root 19163351 Dec  9 18:46 cracklib-large
   -rw-r--r--   1 root root   492822 Dec  9 18:46 cracklib-small
   -rw-r--r--   1 root root      360 Dec  9 18:46 cracklib.magic
   -rw-r--r--   1 root root     1024 Dec 13 00:13 pw_dict.hwm
   -rw-r--r--   1 root root  8771150 Dec 13 00:13 pw_dict.pwd
   -rw-r--r--   1 root root   477896 Dec 13 00:13 pw_dict.pwi

One dictionary consists of the 3 files named '''pw_dict''' while cracklib-large and cracklib-small are the source files read to write extended and standard dictionary respectively.

* At last update the configuration file ''/etc/login.defs'' to enable '''passwd''' command to use cracklib checks. Add a line pointing to the dictionary to use in order to perform checks:
<syntaxhighlight lang="bash">
   CRACKLIB_DICTPATH   /usr/share/cracklib/pw_dict
</syntaxhighlight>

Where ''/usr/share/cracklib'' is the path to the directory containing dictionaries while ''pw_dict'' is the common name shared by the 3 files that make up a dictionary. The ''/etc/login.defs'' file includes a default line of configuration that points to the wrong, usually not existing, file. Comment the line  out:
<syntaxhighlight lang="bash">
   # If compiled with cracklib support, where are the dictionaries
   #CRACKLIB_DICTPATH   /var/cache/cracklib/cracklib_dict
</syntaxhighlight>

Password checking will be enabled immediately after the configuration update:
   jil-big@system:~$ '''passwd'''
   Changing password for jil-big
   Old password: 
   Enter the new password (minimum of 5 characters)
   Please use a combination of upper and lower case letters and numbers.
   New password: 
   Bad password: <font color="red">it is based on a dictionary word.  Try again.</font>
   New password: 
   Bad password: too simple.  Try again.
   New password: 
   Bad password: <font color="red">it is too simplistic/systematic.  Try again.</font>
   New password: 
   Bad password: <font color="red">it is based on a dictionary word.  Try again.</font>
   New password: 
   Bad password: too simple.  Try again.
   The password for jil-big is unchanged. 

Checks are performed '''while updating a password''' therefore affect all the passwords that are set for the first time or reset '''after installing cracklib''', but '''does not automatically touch previously set ones'''. To force a check of all users authentication passwords you'll have to expire them forcing an user update. For example using command:
   '''passwd''' ''-e '' <uset>

Enabling '''cracklib''' for '''passwd''' has a drawback presenting whenever the '''shadow password''' package needs an update. Obviously the updated packages provided by Slackware will not support the library and the system administrator will have to rebuild and update the package following the procedure described above. This additional task '''is required for every package update'''. However we are talking about a very remote eventuality as the programs included in shadow passwords are very mature and widely tested and bugs or security alerts requiring an update are rarely reported.


== Conclusions ==

Cracklib is both an easy to use and performing tool very useful to improve the security of a Linux / UNIX PC or Server as it allows to check the strength of passwords and discard those too easy to guess. This article described in detail a procedure to integrate cracklib with the shadow password authentication system: the standard adopted by Slackware and many other Linux distributions. The integration of the two systems is recommended because it makes the tool available to all users, not just administrators, and makes the check against a dictionary mandatory. The control is performed automatically when updating a password and cannot be circumvented. In the last paragraph of the article I suggested an easy way to "age" the password of a user forcing her / him to update it and, consequently, to perform the check using cracklib.


For any feedback, questions, errors and such, please e-mail me at ''studiosg [at] giustetti [dot] net''


External links

----

* [https://github.com/cracklib/cracklib GitHub Cracklib Page]
* [http://slackbuilds.org/result/?search=cracklib&sv= SlackBuilds.org Cracklib Page]
* [https://en.wikipedia.org/wiki/Pluggable_authentication_module PAM Wikipedia page]
* [https://www.openpam.org The OpenPAM project home page]
* [http://www.linux.com Linux.com home page]
* [http://www.linux.org Linux.org home page]
* [http://www.linuxfoundation.org Linux Foundation home page]

----

{{footer_en | link_page=slackware_integrare_cracklib}}