Birmingham mumbai

[
 64 
]
Next, let's take a look at the following file, which is provided with Ubuntu. Feel free 
to open it with a text editor, such as 
nano
, as we'll need to edit it:
sudo nano /etc/pam.d/common-password
To enable a history requirement for your passwords (meaning the system remembers 
the last several passwords a user has used, preventing them from reusing them), we 
can add the following lines to the file:
password   required   pam_pwhistory.so
remember=99 use_authok
In the example 
config
 line, I'm using 
remember=99
, which (as you can probably 
guess) will cause our system to remember the last 99 passwords for each user and 
prevent them from using those passwords again. If you configured a minimum 
password age earlier, for example, 5 days, it would take the user 495 days to cycle 
back to their original password if you take into account that the user changes their 
password once every 5 days, 99 times. That pretty much makes it impossible for the 
user to utilize their old passwords.
Another field worth mentioning within the 
/etc/pam.d/common-password
 file is the 
section that reads 
difok=3
. This configuration details that at least three characters 
have to be different before the password is considered acceptable. Otherwise, the 
password would be deemed too similar to the old one and refused. You can change 
this value to whatever you like; the default is normally 
5
 but Ubuntu defaults it 
to 
3
 in their implementation of this config file. In addition, you'll also see 
obscure
 
mentioned in the file as well, which prevents simple passwords from being used 
(such as common dictionary words and so on).
An extremely important tip while modifying configuration files 
related to authentication (such as password requirements, 
sudo
 
access, SSH, and so on) is to always keep a 
root
 shell open at all 
times while you make changes, and in another shell, test those 
changes. Do not log out of your 
root
 window until you are 100% 
certain that your changes have been thoroughly tested. While 
testing a policy, make sure that not only can your users log in, but 
your admins too. Otherwise, you may remove your ability to log in 
to a server and make changes. 

---

Chapter 2