This is part 3-4 of a series of posts on server security from Inversoft's 2016 Guide to User Data Security.
Logging in the First Time
First, log into your server as the root user using the password you entered above. To log into the server, execute this command:
$ ssh email@example.com
You can leave this terminal window open while you configure the server. This makes life simpler and will allow you to fix issues if something breaks along the way.
By forcing users to select secure passwords you will prevent users with accounts on your servers from using passwords like
To ensure passwords are secure, you will install a PAM module called Cracklib. This module provides the ability to set password constraints. To install this module, execute this command:
$ apt-get install libpam-cracklib
To make the most of this module, you need to edit the configuration file to require user passwords to contain complex characters including uppercase, lowercase, digits and punctuation. To set this configuration, edit the file
/etc/pam.d/common-password like this:
$ nano /etc/pam.d/common-password
Find the line that starts with:
password requisite pam_cracklib.so
and replace it with:
password requisite pam_cracklib.so retry=3 minlen=10 difok=3 ucredit=-1 lcredit=-2 dcredit=-1 ocredit=-1
The configuration options are as follows:
- Allow 3 retries to type a new password twice before giving up (retry=3)
- Passwords must be at least 10 characters long (minlen=10)
- The new password must differ from the old password by 3 characters (difok=3)
- The new password must contain at least 1 uppercase character (ucredit=-1)
- The new password must contain at least 2 lowercase characters (lcredit=-2)
- The new password must contain at least 1 digit/number (dcredit=-1)
- The new password must contain at least 1 symbol (ocredit=-1)
You can change these values if you wish, but you should ensure users are selecting complex passwords that are hard to brute force attack.