head	1.2;
access;
symbols;
locks; strict;
comment	@# @;


1.2
date	97.02.15.18.25.44;	author morgan;	state Exp;
branches;
next	1.1;

1.1
date	96.11.30.20.59.32;	author morgan;	state Exp;
branches;
next	;


desc
@@


1.2
log
@update for .56
@
text
@<!--
   $Id: pam_cracklib.sgml,v 1.1 1996/11/30 20:59:32 morgan Exp morgan $
   
   This file was written by Andrew G. Morgan <morgan@@parc.power.net>
-->

<sect1>Cracklib pluggable password strength-checker

<sect2>Synopsis

<p>
<descrip>

<tag><bf>Module Name:</bf></tag>

pam_cracklib

<tag><bf>Author:</bf></tag>

Cristian Gafton &lt;gafton@@sorosis.ro&gt;

<tag><bf>Maintainer:</bf></tag>

Author.

<tag><bf>Management groups provided:</bf></tag>

password

<tag><bf>Cryptographically sensitive:</bf></tag>
	
<tag><bf>Security rating:</bf></tag>

<tag><bf>Clean code base:</bf></tag>

<tag><bf>System dependencies:</bf></tag> 

Requires the system library <tt/libcrack/ and a system dictionary:
<tt>/usr/lib/cracklib_dict</tt>.

<tag><bf>Network aware:</bf></tag>

</descrip>

<sect2>Overview of module

<p>
This module can be plugged into the <tt/password/ stack of a given
application to provide some plug-in strength-checking for passwords.
(XXX - note this does not necessarily work with the pam_unix module,
although it is known to work with the pam_pwdb replacement for the
unix module -- see example and pam_pwdb write up for more
information).

<sect2>Password component

<p>
<descrip>

<tag><bf>Recognized arguments:</bf></tag>

<tt/debug/; <tt/type=XXX/; <tt/retry=N/

<tag><bf>Description:</bf></tag>

The action of this module is to prompt the user for a password and
check its strength against a system dictionary and a set of rules for
identifying poor choices.

<p>
The default action is to prompt for a single password, check its
strength and then, if it is considered strong, prompt for the password
a second time (to verify that it was typed correctly on the first
occasion). All being well, the password is passed on to subsequent
modules to be installed as the new authentication token.

<p>
The default action may be modified in a number of ways using the
arguments recognized by the module:
<itemize>

<item> <tt/debug/ -

this option makes the module write information to syslog(3) indicating
the behavior of the module (this option does <bf/not/ write password
information to the log file).

<item> <tt/type=XXX/ -

the default action is for the module to use the following prompts when
requesting passwords: ``New UNIX password: '' and ``Retype UNIX
password: ''. Using this option you can replace the word UNIX with
<tt/XXX/.

<item> <tt/retry=N/ -

the default number of times this module will request a new password
(for strength-checking) from the user is 1. Using this argument this
can be increased to <tt/N/.

</itemize>

<tag><bf>Examples/suggested usage:</bf></tag>

(At the time of writing, this module can only be stacked before the
<tt/pam_pwdb/ module. Cracklib strength checking may be compiled by
default into the <tt/pam_unix/ module.)

<p>
For an example of the use of this module, we show how it may be
stacked with the password component of <tt/pam_pwdb/:
<tscreen>
<verb>
#
# These lines stack two password type modules. In this example the user
# is given 3 opportunities to enter a strong password. The
# "use_authtok" argument ensures that the pam_pwdb module does not
# prompt for a password, but instead uses the one provided by
# pam_cracklib.
#
passwd	password required	pam_cracklib.so retry=3
passwd	password required	pam_pwdb.so use_authtok
</verb>
</tscreen>

</descrip>

<!--
End of sgml insert for this module.
-->
@


1.1
log
@Initial revision
@
text
@d2 1
a2 1
   $Id$
d121 2
a122 2
passwd	password required	/usr/lib/security/pam_cracklib.so retry=3
passwd	password required	/usr/lib/security/pam_pwdb.so use_authtok
@
