This is part 3-4 of a series of posts on server security from Inversoft's 2016 Guide to User Data Security.

Logging in the First Time

First, log into your server as the root user using the password you entered above. To log into the server, execute this command:

$ ssh root@192.81.133.144

You can leave this terminal window open while you configure the server. This makes life simpler and will allow you to fix issues if something breaks along the way.

Securing Passwords

By forcing users to select secure passwords you will prevent users with accounts on your servers from using passwords like "password".

To ensure passwords are secure, you will install a PAM module called Cracklib. This module provides the ability to set password constraints. To install this module, execute this command:

$ apt-get install libpam-cracklib

To make the most of this module, you need to edit the configuration file to require user passwords to contain complex characters including uppercase, lowercase, digits and punctuation. To set this configuration, edit the file /etc/pam.d/common-password like this:

$ nano /etc/pam.d/common-password

Find the line that starts with:

password   requisite    pam_cracklib.so

and replace it with:

password   requisite    pam_cracklib.so retry=3 minlen=10 difok=3 ucredit=-1 lcredit=-2 dcredit=-1 ocredit=-1

The configuration options are as follows:

• Allow 3 retries to type a new password twice before giving up (retry=3)
• Passwords must be at least 10 characters long (minlen=10)
• The new password must differ from the old password by 3 characters (difok=3)
• The new password must contain at least 1 uppercase character (ucredit=-1)
• The new password must contain at least 2 lowercase characters (lcredit=-2)
• The new password must contain at least 1 digit/number (dcredit=-1)
• The new password must contain at least 1 symbol (ocredit=-1)

You can change these values if you wish, but you should ensure users are selecting complex passwords that are hard to brute force attack.