Nciphisa imizamo yephasiwedi ku-Linux ukuze uvikele izinsizakalo ezibalulekile

Nciphisa imizamo yephasiwedi ku-Linux Akuyona nje into engavamile yabaphathi abakhathazekile; kungenye yezindlela eziphumelela kakhulu zokuvimba ukuhlaselwa ngamandla amakhulu kanye nokufinyelela okungagunyaziwe, kokubili ezindaweni zedeskithophu nezeseva. Uma ikhompyutha yakho iqukethe ulwazi olubucayi noma ixhumeka kwi-inthanethi, kuzodingeka uvikele le ngxenye yesistimu. hlola inethiwekhi yakho yendawo.

Ngaphezu kokusetha iphasiwedi eqinile, lungiselela ukukhiya kwesikhashana noma okuhlala njalo ngemva kokwehluleka okuningana Lokhu kubalulekile: kunciphisa ijubane labahlaseli, kudala izingodo ezengeziwe zokuhlola, futhi kukuvumela ukuthi uhlanganise lokhu kuvikela nezinye izinqubomgomo zephasiwedi (ukuphelelwa yisikhathi, ubunzima, ukusetshenziswa kabusha, njll.). Ake sibheke, ngokuthula kodwa ngokuningiliziwe, ukuthi lokhu kwenziwa kanjani ekusatshalalisweni okuhlukene kanye namazinga ahlukene esistimu.

Ukukhiywa kwe-akhawunti ngenxa yemizamo yokungena ehlulekile ku-Red Hat, i-CentOS, kanye ne-derivatives

Ekwabiweni ngokusekelwe ku-Red Hat (RHEL, CentOS, Rocky, AlmaLinux…)Ukuvimba i-akhawunti ngenxa yemizamo ehlulekile kuphathwa nge-module ye-PAM pam_faillockLe module ilawula ukuthi zingaki imizamo yokungena ehlulekile evunyelwe, ukuthi i-akhawunti ikhiywe isikhathi esingakanani, nokuthi yibaphi abasebenzisi abathintekayo (kufaka phakathi, uma ufisa, umsebenzisi oyinhloko).

Ukuze usebenzise le nqubomgomo, udinga ukuhlela amafayela e-PAM omhlaba wonke, ngokuvamile /etc/pam.d/system-auth futhi, kwezinye izinguqulo, futhi /etc/pam.d/password-authLawa mafayela asebenza njengezifanekiso zezinsizakalo eziningi zokuqinisekisa ohlelweni (ukungena ngemvume kwe-console, i-sudo, i-SSH, njll.).

Lawa mafayela aqukethe imigqa efana nale, ngaphakathi kwesigaba se- auth y i-akhawunti:

auth required pam_faillock.so preauth silent audit deny=2 unlock_time=120
auth pam_faillock.so authfail audit deny=2 unlock_time=120
account required pam_faillock.so

Umugqa wokuqala wesenzo ngaphambi kokuqinisekiswa kwangempela (ukuqinisekiswa kwangaphambili)Owesibili usebenza lapho ukuqinisekiswa kwehluleka, kanti owesithathu unesibopho sokuhlola isimo sokukhiya kwe-akhawunti ngesikhathi sesigaba soku- i-akhawuntiNgokushintsha amapharamitha, ungalungisa inqubomgomo ngokwezidingo zakho.

Amapharamitha avame kakhulu pam_faillock Yilezi:

• ukuhlolwa: Ivumela ukuloga okuningiliziwe kwemizamo yokungena ngemvume, ukuze kushiywe imikhondo kulogi yesistimu (isibonelo, ku / var / log / ephephile).
• ukuphika = 2Lokhu kusetha inani eliphezulu lemizamo yephasiwedi ehlulekile ngaphambi kokuba i-akhawunti ikhiywe. Kulesi sibonelo kungu-2, kodwa ungayikhulisa (3, 5, 10…).
• isikhathi_sokuvula=120: kubonisa isikhathi sokuvimba ngemizuzwana. Lapha kuzoba imizuzwana eyi-120 (imizuzu emi-2) kuze kube yilapho i-akhawunti ivuselelwa ngokuzenzakalelayo.
• uthuleUma ikhona, Akubonisi umsebenzisi ukuthi uvinjiweImane iyeke ukwamukela ukungena ngemvume, okwenza uhlelo lungabi "nolimi" oluningi kumhlaseli.

Imininingwane ebalulekile ukuthi, ngokuzenzakalelayo, impande ayifakiwe kuleli bhulokhiUma ufuna imithetho efanayo isebenze kuyo futhi, udinga ukwengeza ipharamitha i-even_deny_root emigqeni ye-pam_faillock yesigaba sokuqinisekisa. Lokhu kuqinisa ukuphepha, kodwa kufanele ulinganisele ingozi yokulahlekelwa ukufinyelela uma wenza amaphutha amaningi kakhulu.

Uma i-akhawunti ikhiyiwe futhi ungasebenzisi ipharamitha uthuleUhlelo lungabonisa imiyalezo ecacile exwayisa ukuthi umsebenzisi udlule inani elivunyelwe lemizamo. Lokhu kuyasiza ezindaweni zokuhlola ukuqinisekisa ukucushwa, yize ekukhiqizweni ngokuvamile kungcono ukunganikezi ulwazi oluningi kakhulu.

Ukuze ubuke imizamo yokungena ngemvume yomsebenzisi othile ehlulekile, kuzinhlelo ze-Red Hat ungasebenzisa umyalo ukukhiya okuhlulekile ekhomba i-akhawunti oyithandayo:

faillock --user lionel

Lo myalo uyabonisa Mingaki imizamo ehlulekile umsebenzisi ayiqoqile?, kufaka phakathi ikheli le-IP elisetshenziswe endabeni ye-SSH kanye neminye imininingwane ehlobene nokuhlolwa. Ngaphezu kwalokho, ungabuyekeza njalo okubonakala ku- / var / log / ephephilelapho lezi zenzakalo zokuphepha zizoqoshwa khona.

Ukukhiywa kwe-akhawunti ngenxa yemizamo yokungena ehlulekile ku-Debian kanye ne-Ubuntu

Endabeni I-Debian, Ubuntu kanye nokuphumaIndlela yokucabanga iyafana, kodwa imodyuli ye-PAM isebenzisa izinguquko. Ngokwesiko, ibilokhu isetshenziswa pam_tally2 ukubala imizamo ehlulekile nokuvimba ama-akhawunti ngokuzenzakalelayo, yize ezinguqulweni zanamuhla kunconywa ukuthuthela ku- pam_faillockNoma kunjalo, i-pam_tally2 isatholakala kakhulu eziqondisweni nasezindaweni eziningi.

Ukuze usebenzise ukukhiya ngokusekelwe enanini lemizamo ehlulekile ku-Debian ejwayelekile, uvame ukuhlela ifayela /etc/pam.d/okuvamile-authokuchaza inqubomgomo yokuqinisekisa ejwayelekile yezinsizakalo eziningi zasendaweni. Ungangeza umugqa onjengalona kuyo:

auth required pam_tally2.so onerr=fail deny=3 unlock_time=120 audit even_deny_root root_unlock_time=600

Ngalesi simiso, uhlelo I-akhawunti ivinjiwe ngemuva kwemizamo emithathu ehlulekile.Igcina ukukhiya imizuzwana eyi-120 kubasebenzisi abavamile kanye nemizuzwana engama-600 yezimpande. Ngaphezu kwalokho, uma kwenzeka iphutha nge-module (i-onerr=ukwehluleka), ngenxa yezizathu zokuphepha ukufinyelela kuyanqatshwa esikhundleni sokuvunyelwa.

Amapharamitha ayinhloko pam_tally2 Yilezi:

• i-onerr=ukwehlulekaUma kunenkinga yokufunda noma ukubuyekeza ikhawunta yokuzama, ukuqinisekiswa kuyanqatshwa ukuze kugwenywe ukushiya umnyango uvuliwe ngengozi.
• ukuphika = 3: Inani eliphezulu lemizamo ehlulekile evunyelwe ngaphambi kokuba i-akhawunti ikhiywe. Inani elingu-3 livame ukuba nengqondo kakhulu ekusebenzeni.
• isikhathi_sokuvula=120: isikhathi ngemizuzwana lapho i-akhawunti izohlala ikhiyiwe kubasebenzisi abajwayelekile.
• ukuhlolwa: ulwazi lokuhluleka kokuqinisekiswa kwe-logs (ku-Debian, ngokuvamile kuba /var/log/auth.log).
• i-even_deny_root: kuphoqa impande ukuthi ibalwe nakule ndlela yokukhiya, into okufanele isetshenziswe ngokuqapha.
• isikhathi_sokuvula_impande=600: isikhathi sokukhiya esithile se-akhawunti yempande, ngemizuzwana, ngaphandle kwabanye abasebenzisi.

Uma i-block ivuliwe, umsebenzisi uzobona umlayezo obonisa ukuthi i-akhawunti yakhe ikhutshaziwe okwesikhashana ngenxa yemizamo eminingi yokungena ehlulekile. Lokhu kuvumela umphathi ukuthi abone ukuziphatha okusolisayo futhi axwayise umsebenzisi ukuthi kukhona okungahambi kahle.

Ukubuka imizamo ehlulekile eqoshwe ngu pam_tally2 Kumsebenzisi othize (isibonelo, i-lionel), ungasebenzisa:

pam_tally2 -u lionel

Lo myalo kukhombisa inani lokwehluleka okuqongelelekile Futhi ikuvumela ukuthi usethe kabusha ikhawunta ngesandla uma kudingeka, ngezinketho ezengeziwe. Ngaphezu kwalokho, njengaku-Red Hat, uhlala unenketho yokubukeza /var/log/auth.log ukuze ubone ngokuningiliziwe ukuthi kwenzekeni emzamweni ngamunye wokuqinisekisa.

Nciphisa imizamo ye-SSH nge-MaxAuthTries

Enye yezindawo zokungena ezivame kakhulu kumaseva e-Linux yi- sshYingakho kubalulekile ukulawula ukuthi zingaki imizamo yokuqinisekisa evunyelwe ngokuxhumeka ngakunye. Yilapho inqubomgomo iqala khona ukusebenza. I-MaxAuthTries, okulungiselelwe kufayela / njll / ssh / sshd_config kusuka kuseva ye-OpenSSH.

Umbono ulula: I-MaxAuthTries ichaza inani eliphezulu lemizamo yokuqinisekisa evunyelwe ngokuxhumeka kwe-SSH ngakunyeUma lo mkhawulo udluliwe, iseva inqamula uxhumano, iphoqa umhlaseli ukuthi aqale iseshini entsha ukuze aqhubeke nokuzama ukuhlanganiswa, okunciphisa kakhulu ijubane lokuhlasela okuzenzakalelayo kwe-brute-force.

Ukuze uyilungiselele, mane uhlele ifayela lokucushwa:

sudo nano /etc/ssh/sshd_config

Okulandelayo, thola noma engeza umugqa onjengalona:

MaxAuthTries 3

Ngaleli nani, Kuvunyelwe imizamo emithathu kuphela yokuqinisekisa ngokuxhumeka kwe-SSH ngakunyeUma umsebenzisi enza iphutha elifanayo izikhathi eziningi, i-sshd daemon iyalikhipha. Ukuze ushintsho lusebenze, isevisi kumele ilayishwe kabusha noma iqalwe kabusha, isibonelo nge:

sudo systemctl restart sshd

I-MaxAuthTries ayithathi indawo yamamojula e-PAM njenge-pam_tally2 noma i-pam_faillock, kodwa kunalokho isebenza ngesikhathi esifanayoIseva ye-SSH ilawula ukuthi zingaki imizamo elandelanayo evunyelwe kuseshini eyodwa, kuyilapho i-PAM igcina inani lomhlaba wonke ngomsebenzisi ngamunye futhi ingavimba i-akhawunti yakhe ezingeni lesistimu.

Ngaphezu kwe-MaxAuthTries, kuyalulekwa ukuhlanganisa ezinye izindlela zokuphepha ze-SSH ukuze isevisi ibe namandla kakhulu:

• Shintsha imbobo ezenzakalelayo: Yeka ukusebenzisa i-port 22 bese uhambisa i-SSH echwebeni elingacacile kahle kusiza ukuhlunga ukuskena okuningi okuzenzakalelayo okuyisisekelo.
• Sebenzisa okhiye bomphakathi esikhundleni samaphasiwedi njeUkuqinisekisa usebenzisa okhiye be-SSH kususa inkinga yamaphasiwedi abuthakathaka futhi kuqine kakhulu ekuhlaselweni yi-brute-force.
• Vimbela imithombo usebenzisa i-firewall noma ulungiselele i-DMZUkuvumela i-SSH kuphela kusuka kumakheli athile e-IP noma kububanzi benethiwekhi kunezela isithiyo esisebenza kahle kakhulu ezingeni lenethiwekhi.

Nciphisa imizamo yokuqinisekisa yendawo nge-PAM

Ngaphandle kwe-SSH, ukuqinisekiswa kwendawo (i-console, ama-TTY, i-sudo, umphathi wokubonisa imidwebo) iphathwa futhi nge-PAM. Ku-Debian naku-Ubuntu, isibonelo, ifayela /etc/pam.d/okuvamile-auth Kuyinhliziyo yalokhu kulungiselelwa, futhi kuzinhlelo zeRed Hat indima yayo idlalwa ukugunyazwa kwesistimu (futhi ngezinye izikhathi ukugunyazwa kwephasiwedi).

Ngaphezu kwamamojula okuvimba azinikele njenge-pam_faillock noma i-pam_tally2, okunye ukusatshalaliswa kuvumela ukukhawulela imizamo yokungena kanye nezikhathi ngqo ngokusebenzisa ukungena ngemvume.defsKuleli fayela, elitholakala ku- /etc/login.defsAmanani afana nalawa alandelayo ayamenyezelwa:

• UKUNGENA_NGEMVUME: inani eliphezulu lokuzama kabusha elivunyelwe esicelweni sokungena ngaphambi kokuyeka inqubo.
• I-LOGIN_TIMEOUT: isikhathi esiphezulu, ngemizuzwana, lapho iseshini yokungena ngemvume ivunyelwe ukuhlala ilinde ukufakwa komsebenzisi.

Isibonelo, uma ulungisa UKUNGENA_NGEMVUME Ngomkhawulo wamaphasiwedi amathathu, umsebenzisi uzoba nemizamo emithathu kuphela yokufaka iphasiwedi yakhe ngesikhathi esisodwa sokungena ngemvume ngaphambi kokuba uhlelo luvale lowo mzamo, okumphoqa ukuthi aqale kabusha inqubo. Ayikhiyi i-akhawunti ngokwayo, kodwa iyakhiya imikhawulo yemizamo ngeseshini ngayinye.

Kufayela elifanayo ukungena ngemvume.defs Ungalungisa nezinye izinhlaka zokuphepha ezifanele, njenge:

• PASS_MAX_DAYS: inani eliphezulu lezinsuku iphasiwedi engasetshenziswa ngazo ngaphambi kokuba iphoqeleke ukuthi ishintshwe.
• Izinsuku ezingu-PASS_MIN_: inani elincane lezinsuku phakathi kokushintsha iphasiwedi, ukuze kugwenywe izinguquko ezivame kakhulu kanye "nezinhlanganisela".
• I-PASS_WARN_AGE: izinsuku zesaziso ngaphambi kokuba iphasiwedi iphelelwe yisikhathi, ukuze umsebenzisi abe nesikhathi sokusabela.
• I-PASS_MIN_LEN y I-PASS_MAX_LEN: ubude bephasiwedi obuncane nobukhulu.
• I-PASS_ALWAYS_WARN: ixwayisa uma iphasiwedi ingahlangabezani nezindinganiso ezithile zamandla.
• I-PASS_CHANGE_TRIES: inani eliphezulu lemizamo yokushintsha iphasiwedi uma iphasiwedi entsha ibhekwa njengelula kakhulu.
• INDLELA_YE-ENCRYPT: i-algorithm ye-hash okufanele isetshenziswe kumaphasiwedi (into evamile namuhla I-SHA-512, okukhonjiswe njengo $6).

Lezi ziqondiso zithinta kakhulu abasebenzisi abasha Lokhu kudalwa ngemva kokulungisa ama-login.defs, ngakho-ke kuyindlela elula yokusungula inqubomgomo eyisisekelo yenhlangano yonke.

Ukuphatha imizamo nokuphelelwa yisikhathi nge-/etc/shadow kanye nomyalo wokushintsha

Ifayela / njll / isithunzi Yilapho uhlelo lugcina khona amaphasiwedi abethelwe abasebenzisi bendawo, kanye nalo lonke ulwazi lokuphelelwa yisikhathi. Nakuba engashintshwa ngesandla nsuku zonke, ukuqonda isakhiwo sawo kusiza kakhulu ekuhloleni nasekuthuthukiseni izinqubomgomo zokuphepha.

Kuwo wonke umugqa we- / njll / isithunzi Kuvela izinkambu eziningana, zihlukaniswe ngamakholoni. Ezifanele kakhulu izinqubomgomo zethu yilezi:

• Igama lomsebenzisi: ikhomba i-akhawunti lapho ezinye izinkambu zingaphansi kwayo.
• Iphasiwedi ebethelwe: igcinwa njenge $id$usawoti$hashed, kuphi $id$ ikhombisa i-algorithm ($1 MD5, $2a$/$2y$ Inhlanzi Enephunga Elibi, $5 SHA-256, $6 SHA-512), kulandelwe usawoti kanye ne-hash.
• Ushintsho lokugcina lwephasiwedi: inani lezinsuku kusukela ngoJanuwari 1, 1970 (isikhathi) lapho yaguqulwa khona okokugcina.
• Izinsuku eziphansi neziphezulu zokusebenzisaBalawula ukuthi iphasiwedi ingashintshwa nini futhi nokuthi iphelelwa nini yisikhathi.
• Izinsuku zesaziso sokuphelelwa yisikhathi: zingaki izinsuku ngaphambi kokuphelelwa yisikhathi lapho iqala ukwazisa umsebenzisi.
• Izinsuku zokungasebenziUma iphasiwedi isiphelelwe yisikhathi, kuthatha isikhathi esingakanani ngaphambi kokuba i-akhawunti ikhutshazwe ngokuphelele?
• Usuku lokuphelelwa yisikhathi kwe-akhawunti ngokuphelele: futhi ngefomethi yezinsuku kusukela ngo-1970, kuphawula isikhathi lapho ukungena ngemvume kungasavunyelwe kulowo msebenzisi.

Ukuphatha la mapharamitha ngaphandle kokuthinta ngqo i-/etc/shadow, kusetshenziswa umyalo olandelayo: shintsha (shintsha ubudala), okukuvumela ukuthi ulungise iphasiwedi kanye nokuphelelwa yisikhathi kwe-akhawunti kubasebenzisi abathile.

Ezinye izinketho ezivamile ze shintsha Yilezi:

• -d, –usuku lokugcina: ibeka usuku lokushintsha kwephasiwedi kokugcina (ngezinsuku kusukela kufomethi ye-epoch noma ngosuku olufundekayo).
• -E, –ukuphelelwa yisikhathi: ibeka usuku lapho i-akhawunti iphelelwa khona yisikhathi.
• -Mina, –angisebenzi: imaka i-akhawunti njengengasebenzi ngemva kwezinsuku eziningana kusukela ekuphelelweni kwesikhathi kwephasiwedi.
• -m, –izinsuku zango-1980: ichaza inani elincane lezinsuku phakathi kokushintsha kwephasiwedi.
• -M, –izinsuku ezingaphezulu: ikhombisa inani eliphezulu lezinsuku lapho iphasiwedi ihlala isebenza khona.
• -W, –izixwayiso: ibeka ukuthi kuzoqala ukwazisa izinsuku ezingaki ngaphambi kokuphelelwa yisikhathi.
• -l, –uhlu: ikhombisa isimo samanje sokuphelelwa yisikhathi somsebenzisi.

Isibonelo, ukuhlola ulwazi lokuphelelwa yisikhathi lomsebenzisi pepe Kungenziwa:

chage -l pepe

Indlela yokuphuma izobonisa usuku loshintsho lokugcina, ukuthi iphasiwedi iphelelwa yisikhathi noma cha, ukungasebenzi, kanye nezinsuku ezincane neziphezulu...phakathi kweminye imininingwane. Ngaleli thuluzi ungasebenzisa izinqubomgomo ngazinye, umsebenzisi ngomsebenzisi, noma kumaskripthi acubungula wonke amaqembu ama-akhawunti.

Izinqubomgomo zobunzima bephasiwedi ezine-pam_cracklib kanye ne-pam_pwquality

Ukunciphisa imizamo yokungena ngephasiwedi kuhle, kodwa uma amaphasiwedi efana nokuthi “123456” noma “qwerty”, ngeke ufike kude kakhulu. Yingakho kubalulekile. phoqa amaphasiwedi aqinile kusetshenziswa amamojula e-PAM afana nalawa pam_cracklib futhi, ezinguqulweni zakamuva, ikhwalithi ye-pam_pw.

Imodyuli ikhwalithi ye-pam_pw Kuyinguquko ye-cracklib, futhi ihlangana namalayibrari afana ne- ikhwalithi ye-libpw ukuqinisekisa ukuthi amaphasiwedi awekho kuzichazamazwi, awamafushane kakhulu, futhi awaphindi amaphethini alula noma idatha yomuntu siqu yomsebenzisi. Ifakiwe ngokomdabu ezindaweni ezisekelwe ku-RHEL futhi ingafakwa ku-Debian/Ubuntu kusetshenziswa amaphakheji afana nalawa i-libpam-cracklib y ikhwalithi ye-libpam.

Uma sekufakiwe, ukucushwa okuyinhloko kuvame ukwenziwa kufayela /etc/security/pwquality.conflapho ungachaza khona amapharamitha obunzima njenge:

• difok: inani lezinhlamvu okumele lihluke kunephasiwedi yangaphambilini.
• minlen: ubude obuncane obamukelekayo bephasiwedi entsha.
• dcredit, ucredit, Ikhredithi, isikweletuAmakhredithi okufaka izinombolo, izinhlamvu ezinkulu, izinhlamvu ezincane, nezinye izinhlamvu.
• Isigaba esincane: inani elincane kakhulu lezinhlobo ezahlukene zezinhlamvu elidingekayo (oonobumba abancane, oonobumba abakhulu, izinombolo, izimpawu).
• maxrepeat: inani eliphezulu lezinhlamvu ezifanayo ezilandelanayo livunyelwe.
• maxclassrepeat: inani eliphezulu lezinhlamvu ezilandelanayo zekilasi elifanayo.
• i-gecoscheck: ihlola ukuthi iphasiwedi ayinawo amagama avela ensimini ye-GECOS (ukuphawula) yomsebenzisi ku-/etc/passwd.
• i-dictpath: indlela eya kwisichazamazwi esetshenziswa ukuhlola ukuthi iphasiwedi iyingxenye yegama elaziwayo.
• amagama: uhlu lwamagama avinjelwe ngokusobala.

Uhlelo lwe izikweletu Iguquguquka kakhulu. Ngokuyisisekelo, iphasiwedi ithola amakhredithi okufaka izinhlamvu ezahlukahlukene; lawo makhredithi angakhokhela ubude obufushane kancane. Isibonelo, nge i-minlen=10 y isikweletu = 2Iphasiwedi enezinhlamvu ezingu-8 enezinombolo ezingu-2 ingadlula isihlungi ngoba ingeza amakhredithi amabili engeziwe. Kodwa-ke, uma uchaza amakhredithi angemahle, udinga okungenani uhlamvu olulodwa olungemahle (isibonelo, isikweletu = -1 (kudinga okungenani inombolo eyodwa, akukho okuhlukile).

cunt Isigaba esincane Ungadinga iphasiwedi ukuthi ifake amakilasi amaningana ahlukene. Inani lamandla ama-2, isibonelo, inhlanganisela yezinhlamvu nezinombolo, noma izinhlamvu nezimpawu, njll. ikilasi elincane = 4 Kuzodinga ukusetshenziswa kwezinhlamvu ezincane, izinhlamvu ezinkulu, izinombolo, kanye nezinhlamvu ezikhethekile ngasikhathi sinye, into ejwayelekile kakhulu ezinqubweni zezinkampani ezifuna kakhulu.

Amathuluzi afana i-pwscore Zikuvumela ukuthi uhlole amandla ephasiwedi uma uqhathanisa nezinqubomgomo ezichaziwe. Uma iphasiwedi idluliswa i-pwscoreLokhu kukutshela ukuthi ukhiye uyahlangabezana yini nezidingo noma cha, futhi uma kungenjalo, yimuphi umthetho owuphulayo (ubude obunganele, obulula kakhulu, obufana kakhulu nowangaphambilini, njll.).

Lungiselela izinqubomgomo eziqinile ku-Debian naku-Ubuntu nge-pam_cracklib

Kuzinhlelo ze-Debian/Ubuntu kuvamile kakhulu ukusebenzisa pam_cracklib (noma i-pwquality nge-PAM) ukuze kuqinisekiswe inqubomgomo yephasiwedi. Ifayela eliyisihluthulelo lapha yileli /etc/pam.d/okuvamile-iphasiwedi, okuchaza indlela izinguquko zephasiwedi eziphathwa ngayo kubasebenzisi bohlelo.

Ngaphambi kokuthinta noma yini, kuwumkhuba omuhle ukwenza ikhophi eyisipele yefayela:

sudo cp /etc/pam.d/common-password /root/

Ngemuva kwalokho ungayihlela ngesihleli sakho sombhalo osithandayo (i-nano, i-vim, njll.) ngamalungelo e-superuser. Ngaphakathi uzothola umugqa ofana no:

password requisite pam_cracklib.so retry=3 minlen=8 difok=3

Lapha, kuchazwa amapharamitha afana nalawa alandelayo:

• zama futhi: inani lemizamo evunyelwe umsebenzisi lapho eshintsha iphasiwedi yakhe, ngaphambi kokuba ushintsho luhluleke.
• minlen: ubude obuncane bephasiwedi.
• difok: inani lezinhlamvu okumele lihluke kunephasiwedi yangaphambilini.
• ucredit, Ikhredithi, dcredit, isikweletu: amakhredithi amahle noma amabi ezinhlamvu ezinkulu, izinhlamvu ezincane, izinombolo, nezinye izinhlamvu.

Isibonelo, inqubomgomo enzima kakhulu ingaba:

password requisite pam_cracklib.so retry=3 minlen=12 difok=3 ucredit=-3 lcredit=-3 dcredit=-3 ocredit=-3

Ngalokhu kusetha, Iphasiwedi entsha ngayinye kumele okungenani ibe nezinhlamvu ezingu-12 ubudeIphasiwedi kumele ihluke okungenani ngezinhlamvu ezintathu kweyangaphambilini futhi ibe nezinhlamvu ezinkulu okungenani ezintathu, izinhlamvu ezincane ezintathu, izinombolo ezintathu, kanye nezimpawu ezintathu. Kuyinqubomgomo eqinile kakhulu, kodwa isebenza kahle kakhulu ngokumelene namaphasiwedi angasho lutho.

Uma usushintshe inqubomgomo, ungayihlola ngokushintsha iphasiwedi yakho nge:

sudo passwd

Uma iphasiwedi ingahlangabezani nezidingo, uhlelo luzobonisa imiyalezo ekhombisa isizathu: imfushane kakhulu, efana negama lesichazamazwi, ukuphindaphinda ngokweqile kwezinhlamvu, njll. Uma iphasiwedi isihambisana nenqubomgomo, ushintsho luzosetshenziswa ngaphandle kwenkinga.

Ngaphezu kokuqinisa inqubomgomo yezinguquko ezintsha, i-Debian ne-Ubuntu zivumela phoqelela abasebenzisi abakhona ukuthi bashintshe iphasiwedi yabo ukuzivumelanisa nemithetho emisha. Ngomyalo:

passwd -e USUARIO

Iphasiwedi yalowo msebenzisi imakwe njengephelelwe yisikhathi, futhi ekungeneni kwakhe okulandelayo, kuzodingeka ukuthi asethe iphasiwedi entsha ehambisana nenqubomgomo yamanje. Ungalawula nokuphelelwa yisikhathi kwephasiwedi yomhlaba wonke nge:

passwd -w 5 -x 30 USUARIO

kuphi -x 30 isungula ukusebenza okuphezulu kwezinsuku ezingama-30 zephasiwedi kanye -w 5 Lokhu kwenza uhlelo luqale ukukwazisa ezinsukwini ezi-5 ngaphambi kosuku lokuphelelwa yisikhathi. Uma wengeza -ngi 1:

passwd -w 5 -x 30 -i 1 USUARIO

I-akhawunti izomakwa njengengasebenzi uma umsebenzisi engashintshi iphasiwedi yakhe. ngosuku olulodwa ngemuva kokuphelelwa yisikhathi, okuphoqa umphathi ukuthi angenelele ukuze aphinde ayisebenzise.

Nakuba ukujikelezisa amaphasiwedi kuye kwanconywa iminyaka eminingi, iziqondiso zokuphepha zanamuhla (njengalezo ezivela ku-NIST) ziyawufanelekela lo mkhuba: Kungcono ukukhetha amaphasiwedi amade futhi ayinkimbinkimbi, kanye nezinhlelo zokuqinisekisa izinto ezimbili, kunokuphoqelela izinguquko ezivame kakhulu ezigcina zikhiqiza okhiye ababikezelwayo.

Lungiselela ngokucophelela amamojula e-PAM (pam_faillock, pam_tally2, pam_cracklib, pam_pwquality), kanye namafayela ayisihluthulelo afana nalawa /etc/pam.d/okuvamile-auth, /etc/pam.d/okuvamile-iphasiwedi, /etc/login.defs, / njll / ssh / sshd_config futhi baqonde ukuthi lezo zinqumo zibonakala kanjani ku / njll / isithunziLokhu kuphawula umehluko phakathi kohlelo "olujwayelekile" nendawo eqinile ngempela ngokumelene nokufinyelela okungagunyaziwe kanye nokuhlaselwa ngamandla amakhulu.