CHECKPASSWD(8)

NAME
checkpasswd - check passwords

SYNOPSIS
checkpasswd [ -c config_file ] [ -e ] [ -o ] [ -s ] [ -u user id ] [ -V ] [ -? ]

DESCRIPTION
Checkpasswd reads passwords from the standard input and subjects them to suitablity tests. These tests are detailed below. It purposely does not take a password argument since process arguments are not secure on most UNIX systems - they can be printed by ps(1).

Checkpasswd is not meant as a replacement for passwd(1) and so does not suppress character echo while reading passwords. The standard input can be redirected from a pipe or file, which facilitates it being called from another program such as passwd(1).

Checkpasswd exits with the check status for the most recent password entered. The check status is one of the following:
-1	A serious error occured.
0	The password passed all checks.
1	The password was a null string.
2	The password was 'too easy' to guess.
3	The password was part of the users 'finger' information.
4	The password was found in a dictionary search.
5	The password contained an illegal character or sequence.
6	The password was too short.

In addition to the check status, an informative message is printed to the standard output (unless supressed).

The options available are:

-c  Take the next argument as the configuration file to read. See the CONFIGURATION section for information on the configuration file.

-e  Print the check status in numeric form as well as the informative message. This is useful for programs which want to process the output from checkpasswd.

-o  Test one password only and exit with check status.

-s  Supress output of informative messages.

-u  Take the next argument as the user id (in numeric form) to use for password file data checking. This option is restricted to the super-user.

-V  Print version information.

-?  Print help message.

CHECKS PERFORMED

Checkpasswd performs the following tests on each password:

1.  Length is checked to see if it is within bounds. Passwords which are too short are rejected, while passwords that are 'too long' are passed but a warning message issued.

2.  The password is scanned for illegal characters and character combinations, such as runs of the same character (e.g. 'aaa'). Passwords that do not use upper and lower case alphabetics will be rejected unless otherwise specified via the configuration file.

3.  The password is checked against various per-site information, such as the host name.

4.  The password is checked against the passwd(5) information for the user. The password is compared against a number of permutations of this data.

5.  The password is checked against the user's 'finger' information.

6.  The password is search for in a list of dictionaries and is rejected if it is found in any of them.

CONFIGURATION

Many of the criteria used by checkpasswd can be set via a configuration file. The default configuration file is /usr/adm/checkpasswd.cf.

Lines in the configuration file which start with '#' ignored. Items in '[ ]' are optional, the default value is in '{ }'.

dictionary	/path/to/dictionary	[description of dictionary]
    Specifies a dictionary to look in. If there is a DBM data base version of the dictionary, that will be used, else egrep will be used on the file. There may be multiple dictionary directives in the configuration file, and they will be searched in the order given. A list of default dictionaries may be built into checkpasswd.
    The makedict program can be used to build DBM dictionaries, and viewdict used to review them.

singlecase	yes | {no}
    Specifies whether or not single-case passwords are legal. The default is to reject single-case passwords.

minlength	N {5}
    Specifies the minimum password length to accept. Passwords shorter that this will not be accepted.

maxlength	N {8}
    Specifies the maximum effective password length. This does not affect acceptance of a password. The crypt(3) routine usually encrypts only the first 8 characters of a string due to the algorithim used. If the password is longer than this, a warning message is printed to inform the user that not the entire password will be used.

printonly	yes | {no}
    Specifies that only printable ASCII characters are to be allowed in passwords. Use of control characters should be encouraged but may cause problems on some systems.

badchars	"list-of-characters"
badchars	+"list-of-characters"
    Specifies a list of characters which are not allowed in passwords. The first form replaces the illegal character table. The second form adds to the illegal character table. Characters may be given in the following forms:
    C special character escapes (e.g. \t )
    \0[0-7] (e.g. \013)
    \0x[0-9 a-f] (e.g. \0xa)
    ^[a-z,A-Z,[,\,],^,-] (e.g.,^c)

    The default content of the illegal characters table is a collection of terminal special characters.

SEE ALSO
makedict, viewdict, passwd(1)

AUTHOR
Clyde Hoover
Computation Center
The University of Texas at Austin
Austin, Texas
clyde@emx.utexas.edu, uunet!cs.utexas.edu!ut-emx!clyde