Over a million developers have joined DZone.

11 Steps to Secure Your Servers Part 3 & 4: Login and Securing Passwords

Parts 3 and 4 of a series of posts on server security from Inversoft's 2016 Guide to User Data Security.

· Performance Zone

Discover 50 of the latest mobile performance statistics with the Ultimate Guide to Digital Experience Monitoring, brought to you in partnership with Catchpoint.

This is part 3-4 of a series of posts on server security from Inversoft's 2016 Guide to User Data Security.

Logging in the First Time

First, log into your server as the root user using the password you entered above. To log into the server, execute this command:

$ ssh root@192.81.133.144

You can leave this terminal window open while you configure the server. This makes life simpler and will allow you to fix issues if something breaks along the way.

Securing Passwords

By forcing users to select secure passwords you will prevent users with accounts on your servers from using passwords like "password".

To ensure passwords are secure, you will install a PAM module called Cracklib. This module provides the ability to set password constraints. To install this module, execute this command:

$ apt-get install libpam-cracklib

To make the most of this module, you need to edit the configuration file to require user passwords to contain complex characters including uppercase, lowercase, digits and punctuation. To set this configuration, edit the file /etc/pam.d/common-password like this:

$ nano /etc/pam.d/common-password

Find the line that starts with:

password   requisite    pam_cracklib.so

and replace it with:

password   requisite    pam_cracklib.so retry=3 minlen=10 difok=3 ucredit=-1 lcredit=-2 dcredit=-1 ocredit=-1

The configuration options are as follows:

  • Allow 3 retries to type a new password twice before giving up (retry=3)
  • Passwords must be at least 10 characters long (minlen=10)
  • The new password must differ from the old password by 3 characters (difok=3)
  • The new password must contain at least 1 uppercase character (ucredit=-1)
  • The new password must contain at least 2 lowercase characters (lcredit=-2)
  • The new password must contain at least 1 digit/number (dcredit=-1)
  • The new password must contain at least 1 symbol (ocredit=-1)

You can change these values if you wish, but you should ensure users are selecting complex passwords that are hard to brute force attack.

Is your APM strategy broken? This ebook explores the latest in Gartner research to help you learn how to close the end-user experience gap in APM, brought to you in partnership with Catchpoint.

Topics:
secure ,security ,security best practices ,password strength ,server

Published at DZone with permission of Kelly Strain. See the original article here.

Opinions expressed by DZone contributors are their own.

The best of DZone straight to your inbox.

SEE AN EXAMPLE
Please provide a valid email address.

Thanks for subscribing!

Awesome! Check your inbox to verify your email so you can start receiving the latest in tech news and resources.
Subscribe

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}