> For the complete documentation index, see [llms.txt](https://noreply.gitbook.io/born2beroot/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://noreply.gitbook.io/born2beroot/virtual-machine-setup/password-policy.md).

# password policy 🔑

## Setting up basic password aging

1. **Edit login definitions:** First, we need to edit the login.defs file:

```sh
nano /etc/login.defs
```

2. **Modify password parameters:** Locate and change the following parameters:

> Change: `PASS_MAX_DAYS 99999` → `PASS_MAX_DAYS 30`

> Change: `PASS_MIN_DAYS 0` → `PASS_MIN_DAYS 2`

<figure><img src="https://3975474142-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvxQldFCzdjsw8BkClhdK%2Fuploads%2Fgit-blob-e2c2ed815656b61da1ab36c7d6062c679c6e3199%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

{% hint style="info" %} <mark style="color:green;">PASS\_MAX\_DAYS</mark>: Maximum number of days before password expires.

<mark style="color:green;">PASS\_MIN\_DAYS</mark>: Minimum number of days before password can be changed.

<mark style="color:green;">PASS\_WARN\_AGE</mark>: Number of days before password expiration to show warning.
{% endhint %}

## Installing password quality enforcement

3. **Install password quality library:** To enforce password quality rules, install the following package:

```sh
sudo apt install libpam-pwquality
```

Type `Y` when prompted to confirm and wait for the installation to complete.

<figure><img src="https://3975474142-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvxQldFCzdjsw8BkClhdK%2Fuploads%2Fgit-blob-f6d198d4f4e7cb20e1ea46730f999305fe5ebc8a%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

## Configuring password complexity rules

4. **Edit PAM configuration:** Next, we need to edit the PAM (Pluggable Authentication Modules) configuration file:

```sh
nano /etc/pam.d/common-password
```

<figure><img src="https://3975474142-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvxQldFCzdjsw8BkClhdK%2Fuploads%2Fgit-blob-853e78fa396734c8e0120d1b69e47dbbb2ff5965%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

5. Below **retry=3** we must add the following commands:

```
minlen=10 ucredit=-1 dcredit=-1 lcredit=-1 maxrepeat=3 reject_username difok=7 enforce_for_root
```

This is how the line must be↙️

<figure><img src="https://3975474142-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvxQldFCzdjsw8BkClhdK%2Fuploads%2Fgit-blob-ee7e863af99025f1ccf6e5e59b6a6e941393e6d2%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

This is how the file must look ↙️

<figure><img src="https://3975474142-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvxQldFCzdjsw8BkClhdK%2Fuploads%2Fgit-blob-5048693d24310b891b178620dff980a4710a3cd3%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

{% hint style="info" %} <mark style="color:green;">minlen=10</mark> ➤ The minimum characters a password must contain.

<mark style="color:green;">ucredit=-1</mark> ➤ The password must contain at least one capital letter. We must write it with a - sign, as this is how it knows that it refers to minimum characters; if we put a + sign it will refer to maximum characters.

<mark style="color:green;">dcredit=-1</mark> ➤ The password must contain at least one digit.

<mark style="color:green;">lcredit=-1</mark> ➤ The password must contain at least one lowercase letter.

<mark style="color:green;">maxrepeat=3</mark> ➤ The password cannot have the same character repeated three consecutive times.

<mark style="color:green;">reject\_username</mark> ➤ The password cannot contain the username within itself.

<mark style="color:green;">difok=7</mark> ➤ The password must contain at least seven different characters from the last password used.

<mark style="color:green;">enforce\_for\_root</mark> ➤ We will implement this password policy for root.
{% endhint %}