Over a million developers have joined DZone.
{{announcement.body}}
{{announcement.title}}

11 Steps to Secure Your Servers Part 3 & 4: Login and Securing Passwords

DZone's Guide to

11 Steps to Secure Your Servers Part 3 & 4: Login and Securing Passwords

Parts 3 and 4 of a series of posts on server security from Inversoft's 2016 Guide to User Data Security.

· Performance Zone
Free Resource

Evolve your approach to Application Performance Monitoring by adopting five best practices that are outlined and explored in this e-book, brought to you in partnership with BMC.

This is part 3-4 of a series of posts on server security from Inversoft's 2016 Guide to User Data Security.

Logging in the First Time

First, log into your server as the root user using the password you entered above. To log into the server, execute this command:

$ ssh root@192.81.133.144

You can leave this terminal window open while you configure the server. This makes life simpler and will allow you to fix issues if something breaks along the way.

Securing Passwords

By forcing users to select secure passwords you will prevent users with accounts on your servers from using passwords like "password".

To ensure passwords are secure, you will install a PAM module called Cracklib. This module provides the ability to set password constraints. To install this module, execute this command:

$ apt-get install libpam-cracklib

To make the most of this module, you need to edit the configuration file to require user passwords to contain complex characters including uppercase, lowercase, digits and punctuation. To set this configuration, edit the file /etc/pam.d/common-password like this:

$ nano /etc/pam.d/common-password

Find the line that starts with:

password   requisite    pam_cracklib.so

and replace it with:

password   requisite    pam_cracklib.so retry=3 minlen=10 difok=3 ucredit=-1 lcredit=-2 dcredit=-1 ocredit=-1

The configuration options are as follows:

  • Allow 3 retries to type a new password twice before giving up (retry=3)
  • Passwords must be at least 10 characters long (minlen=10)
  • The new password must differ from the old password by 3 characters (difok=3)
  • The new password must contain at least 1 uppercase character (ucredit=-1)
  • The new password must contain at least 2 lowercase characters (lcredit=-2)
  • The new password must contain at least 1 digit/number (dcredit=-1)
  • The new password must contain at least 1 symbol (ocredit=-1)

You can change these values if you wish, but you should ensure users are selecting complex passwords that are hard to brute force attack.

Learn tips and best practices for optimizing your capacity management strategy with the Market Guide for Capacity Management, brought to you in partnership with BMC.

Topics:
secure ,security ,security best practices ,password strength ,server

Published at DZone with permission of Kelly Strain. See the original article here.

Opinions expressed by DZone contributors are their own.

THE DZONE NEWSLETTER

Dev Resources & Solutions Straight to Your Inbox

Thanks for subscribing!

Awesome! Check your inbox to verify your email so you can start receiving the latest in tech news and resources.

X

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}