<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> I have a small challenge and would appreciate any guidance… I have been required to determine the length of a new password during a RHEL6 password change.<o:p></o:p> I have modified the PAM source code, by adding an “if” statement in /modules/pam_unix/pam_unix_password.c (shown below) to do this after the password has been changed. <o:p></o:p> This “if” statement works perfectly when the password is changed from the login screen. BUT, if I run the “passwd” command from a terminal window, the statement does not appear to run at all. Can you please help me understand why? <o:p></o:p> ...<o:p></o:p> static int _pam_unix_approve_pass(pam_handle_t * pamh<o:p></o:p> ,unsigned int ctrl<o:p></o:p> ,const char *pass_old<o:p></o:p> ,const char *pass_new)<o:p></o:p> {<o:p></o:p> const void *user;<o:p></o:p> const char *remark = NULL;<o:p></o:p> int retval = PAM_SUCCESS;<o:p></o:p> <o:p> </o:p> D(("&new=%p, &old=%p", pass_old, pass_new));<o:p></o:p> D(("new=[%s]", pass_new));<o:p></o:p> D(("old=[%s]", pass_old));<o:p></o:p> <o:p> </o:p> if (pass_new == NULL || (pass_old && !strcmp(pass_old, pass_new))) {<o:p></o:p> if (on(UNIX_DEBUG, ctrl)) {<o:p></o:p> pam_syslog(pamh, LOG_DEBUG, "bad authentication token");<o:p></o:p> }<o:p></o:p> _make_remark(pamh, ctrl, PAM_ERROR_MSG, pass_new == NULL ?<o:p></o:p> _("No password supplied") : _("Password unchanged"));<o:p></o:p> return PAM_AUTHTOK_ERR;<o:p></o:p> }<o:p></o:p> /*<o:p></o:p> * if one wanted to hardwire authentication token strength<o:p></o:p> * checking this would be the place - AGM<o:p></o:p> */<o:p></o:p> <o:p> </o:p> retval = pam_get_item(pamh, PAM_USER, &user);<o:p></o:p> if (retval != PAM_SUCCESS) {<o:p></o:p> if (on(UNIX_DEBUG, ctrl)) {<o:p></o:p> pam_syslog(pamh, LOG_ERR, "Can not get username");<o:p></o:p> return PAM_AUTHTOK_ERR;<o:p></o:p> }<o:p></o:p> }<o:p></o:p> if (off(UNIX__IAMROOT, ctrl)) {<o:p></o:p> if (strlen(pass_new) < 6)<o:p></o:p> remark = _("You must choose a longer password");<o:p></o:p> D(("length check [%s]", remark));<o:p></o:p> <o:p> </o:p> *******************************************<o:p></o:p> **//added the 13 character password check**<o:p></o:p> **if(strlen(pass_new) >=13)**<o:p></o:p> **system("echo 13char > /tmp/Password_length.text");**<o:p></o:p> *******************************************<o:p></o:p> <o:p> </o:p> if (on(UNIX_REMEMBER_PASSWD, ctrl)) {<o:p></o:p> if ((retval = check_old_password(user, pass_new)) == PAM_AUTHTOK_ERR)<o:p></o:p> remark = _("Password has been already used. Choose another.");<o:p></o:p> if (retval == PAM_ABORT) {<o:p></o:p> pam_syslog(pamh, LOG_ERR, "can't open %s file to check old passwords",<o:p></o:p> OLD_PASSWORDS_FILE);<o:p></o:p> return retval;<o:p></o:p> }<o:p></o:p> }<o:p></o:p> }<o:p></o:p> ...<o:p></o:p> <o:p> </o:p> <o:p> </o:p> Thank you, Stephanie Formica Enroute Computer Solutions FDIO - Second Level Support Phone: (609) 485-4077<o:p></o:p> <o:p> </o:p> </div> </body> </html>