281 lines
9.2 KiB
Markdown
281 lines
9.2 KiB
Markdown
|
|
||
|
|
太好了 — 你已经贴出了 `password-auth` 的当前内容，基于它我会直接给出**可复制的、安全步骤**：先备份，再替换为建议的密码策略（使用 `pam_pwquality`，最小长度 12、`difok=3`、至少 3 类字符、并在 `pam_unix` 上启用密码历史 `remember=5`）。同时我会说明为什么这样改、如何测试，以及如何回滚。
|
||
|
|
|
||
|
|
> 说明：我保留 `pam_pwquality` 为 `requisite`（与你当前一致），因为这会在强度检查失败时立即终止并拒绝密码更改，减少后续模块运行。但如果你希望即使强度检查失败也执行后续模块（例如记录历史或其它处理），可以把它改成 `required`。我在下面也给出小备注。
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 一步一步来（复制黏贴即可）
|
||
|
|
|
||
|
|
1. 先备份原文件：
|
||
|
|
|
||
|
|
|
||
|
|
```bash
|
||
|
|
cp /etc/pam.d/password-auth /etc/pam.d/password-auth.bak.$(date +%F_%T)
|
||
|
|
ls -l /etc/pam.d/password-auth*
|
||
|
|
```
|
||
|
|
|
||
|
|
2. 将下面内容写入临时文件并做替换（安全写入）：
|
||
|
|
|
||
|
|
|
||
|
|
```bash
|
||
|
|
cat <<'EOF' | tee /etc/pam.d/password-auth.new >/dev/null
|
||
|
|
# /etc/pam.d/password-auth - modified recommended settings
|
||
|
|
auth required pam_kysec.so
|
||
|
|
#%PAM-1.0
|
||
|
|
|
||
|
|
auth required pam_env.so
|
||
|
|
auth required pam_faillock.so preauth audit deny=3 even_deny_root unlock_time=60
|
||
|
|
#auth sufficient pam_fprintd.so
|
||
|
|
auth sufficient pam_unix.so nullok try_first_pass
|
||
|
|
#auth sufficient pam_sss.so use_first_pass
|
||
|
|
auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=60
|
||
|
|
auth sufficient pam_faillock.so authsucc audit deny=3 even_deny_root unlock_time=60
|
||
|
|
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
|
||
|
|
auth required pam_deny.so
|
||
|
|
|
||
|
|
account required pam_unix.so
|
||
|
|
account sufficient pam_localuser.so
|
||
|
|
account sufficient pam_succeed_if.so uid < 1000 quiet
|
||
|
|
#account [default=bad success=ok user_unknown=ignore] pam_sss.so
|
||
|
|
account required pam_permit.so
|
||
|
|
|
||
|
|
# Password quality: enforce length, classes, difok
|
||
|
|
# - minlen=12 : minimal length (increase if you want stronger)
|
||
|
|
# - difok=3 : new password must differ in at least 3 characters from old
|
||
|
|
# - minclass=3: at least 3 character classes (uppercase, lowercase, digit, other)
|
||
|
|
# - u/l/d/ocredit -1 : require at least one of each (set ocredit=0 to make special char optional)
|
||
|
|
password requisite pam_pwquality.so retry=3 minlen=12 difok=3 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=0 local_users_only
|
||
|
|
|
||
|
|
# UNIX module performs the actual password change and supports history
|
||
|
|
# remember=5 : prevent reuse of last 5 passwords
|
||
|
|
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
|
||
|
|
|
||
|
|
# If you have SSSD and want it to accept the token, uncomment below (but test first)
|
||
|
|
#password sufficient pam_sss.so use_authtok
|
||
|
|
|
||
|
|
password required pam_deny.so
|
||
|
|
|
||
|
|
session optional pam_keyinit.so revoke
|
||
|
|
session required pam_limits.so
|
||
|
|
#session optional pam_systemd.so
|
||
|
|
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||
|
|
session required pam_unix.so
|
||
|
|
#session optional pam_sss.so
|
||
|
|
EOF
|
||
|
|
```
|
||
|
|
|
||
|
|
```bash
|
||
|
|
mv /etc/pam.d/password-auth /etc/pam.d/password-auth.orig.$(date +%F_%T)
|
||
|
|
mv /etc/pam.d/password-auth.new /etc/pam.d/password-auth
|
||
|
|
chmod 644 /etc/pam.d/password-auth
|
||
|
|
ls -l /etc/pam.d/password-auth*
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 为什么这样改（要点）
|
||
|
|
|
||
|
|
- `pam_pwquality.so minlen=12 difok=3 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=0`
|
||
|
|
|
||
|
|
- 最短 12 个字符、至少 3 类字符、与旧密码至少 3 个字符不同。`ocredit=0` 表示**特殊字符非强制但建议**（若你要强制特殊字符，将 `ocredit=-1`）。
|
||
|
|
|
||
|
|
- `pam_unix.so ... remember=5`
|
||
|
|
|
||
|
|
- 实际写入 `/etc/shadow` 的模块，`remember=5` 阻止重复最近 5 个密码（提升安全性）。
|
||
|
|
|
||
|
|
- 保留 `pam_faillock`：继续防暴力破解（失败 3 次锁 60 秒）。
|
||
|
|
|
||
|
|
- `pam_deny.so` 保持在最后以确保策略失败时拒绝。
|
||
|
|
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 测试（非常重要）
|
||
|
|
|
||
|
|
在替换后不要立刻登出 root。先用一个普通用户或测试账号验证：
|
||
|
|
|
||
|
|
1. 创建测试用户（如果没有）：
|
||
|
|
|
||
|
|
|
||
|
|
```bash
|
||
|
|
sudo useradd -m testpwuser || true
|
||
|
|
sudo passwd testpwuser # 按提示设置一个弱密码测试（应被拒绝）
|
||
|
|
```
|
||
|
|
|
||
|
|
2. 测试几种密码：
|
||
|
|
|
||
|
|
|
||
|
|
- 尝试 `abc123`（应失败）
|
||
|
|
|
||
|
|
- 尝试 `Abcdef12345`（若满足 minlen & classes 应通过）
|
||
|
|
|
||
|
|
- 尝试重复旧密码（应被 `remember=5` 拒绝）
|
||
|
|
|
||
|
|
|
||
|
|
3. 查看认证日志：
|
||
|
|
|
||
|
|
|
||
|
|
```bash
|
||
|
|
sudo tail -n 200 /var/log/auth.log # 或 /var/log/secure，视系统而定
|
||
|
|
# 或实时监测：
|
||
|
|
sudo tail -f /var/log/auth.log
|
||
|
|
```
|
||
|
|
|
||
|
|
4. 如果你使用 SSH，需要测试 `passwd` 改密是否与 SSH 有影响（通常没有），但如果你的环境有集中认证（SSSD/LDAP），请特别测试这些路径。
|
||
|
|
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 回滚（若出现问题）
|
||
|
|
|
||
|
|
如果验证失败或导致登录异常，立刻恢复备份：
|
||
|
|
|
||
|
|
```bash
|
||
|
|
# 恢复最初备份
|
||
|
|
sudo cp /etc/pam.d/password-auth.bak.* /etc/pam.d/password-auth
|
||
|
|
# 或恢复刚做的原始文件
|
||
|
|
sudo mv /etc/pam.d/password-auth.orig.* /etc/pam.d/password-auth
|
||
|
|
```
|
||
|
|
|
||
|
|
然后重启相关服务或直接重启机器（如果需要）。
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 额外建议（可选）
|
||
|
|
|
||
|
|
- 若你希望强制所有四类字符（UPPER+lower+digit+special），把 `ocredit=0` 改成 `ocredit=-1`（并把 `minclass=3` 可留或删）。
|
||
|
|
|
||
|
|
- 如果你更希望**即使强度检查失败也执行后续模块**（例如记录历史、通知或其它逻辑），可把 `password requisite pam_pwquality.so ...` 改为 `password required ...`。
|
||
|
|
|
||
|
|
- 如果系统使用 SSSD/LDAP，请确认是否需要在 `password` 区块保留 `pam_sss.so use_authtok`（我在建议中注释了它，避免在没有 SSSD 测试的系统上造成问题）。若你确实使用 SSSD，请取消注释并测试。
|
||
|
|
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
如果你愿意，我可以：
|
||
|
|
|
||
|
|
- 直接检查你当前 `/etc/pam.d/system-auth` 或 `/etc/pam.d/common-password`（如果存在）并给出一致化建议；
|
||
|
|
|
||
|
|
- 或根据你的偏好（更严格：强制特殊字符 / 更宽松：允许 passphrase）把上面的配置调成两个不同的“严格度模板”供你选择并直接生成替换命令。
|
||
|
|
|
||
|
|
|
||
|
|
现在我已经把一个安全性较好的建议给出——要我继续把 `system-auth` / `common-password` 一并对齐吗？
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
项目：4
|
||
|
|
|
||
|
|
|
||
|
|
```bash
|
||
|
|
|
||
|
|
cp /etc/pam.d/password-auth /etc/pam.d/password-auth.bak.$(date +%F_%T)
|
||
|
|
ls -l /etc/pam.d/password-auth*
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
```bash
|
||
|
|
|
||
|
|
cat <<'EOF' | tee /etc/pam.d/password-auth.new >/dev/null
|
||
|
|
# /etc/pam.d/password-auth - modified recommended settings
|
||
|
|
auth required pam_kysec.so
|
||
|
|
#%PAM-1.0
|
||
|
|
|
||
|
|
auth required pam_env.so
|
||
|
|
auth required pam_faillock.so preauth audit deny=3 even_deny_root unlock_time=60
|
||
|
|
#auth sufficient pam_fprintd.so
|
||
|
|
auth sufficient pam_unix.so nullok try_first_pass
|
||
|
|
#auth sufficient pam_sss.so use_first_pass
|
||
|
|
auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=60
|
||
|
|
auth sufficient pam_faillock.so authsucc audit deny=3 even_deny_root unlock_time=60
|
||
|
|
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
|
||
|
|
auth required pam_deny.so
|
||
|
|
|
||
|
|
account required pam_unix.so
|
||
|
|
account sufficient pam_localuser.so
|
||
|
|
account sufficient pam_succeed_if.so uid < 1000 quiet
|
||
|
|
#account [default=bad success=ok user_unknown=ignore] pam_sss.so
|
||
|
|
account required pam_permit.so
|
||
|
|
|
||
|
|
# Password quality: enforce length, classes, difok
|
||
|
|
# - minlen=12 : minimal length (increase if you want stronger)
|
||
|
|
# - difok=3 : new password must differ in at least 3 characters from old
|
||
|
|
# - minclass=3: at least 3 character classes (uppercase, lowercase, digit, other)
|
||
|
|
# - u/l/d/ocredit -1 : require at least one of each (set ocredit=0 to make special char optional)
|
||
|
|
password requisite pam_pwquality.so retry=3 minlen=12 difok=3 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=0 local_users_only
|
||
|
|
|
||
|
|
# UNIX module performs the actual password change and supports history
|
||
|
|
# remember=5 : prevent reuse of last 5 passwords
|
||
|
|
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
|
||
|
|
|
||
|
|
# If you have SSSD and want it to accept the token, uncomment below (but test first)
|
||
|
|
#password sufficient pam_sss.so use_authtok
|
||
|
|
|
||
|
|
password required pam_deny.so
|
||
|
|
|
||
|
|
session optional pam_keyinit.so revoke
|
||
|
|
session required pam_limits.so
|
||
|
|
#session optional pam_systemd.so
|
||
|
|
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||
|
|
session required pam_unix.so
|
||
|
|
#session optional pam_sss.so
|
||
|
|
EOF
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
mv /etc/pam.d/password-auth.new /etc/pam.d/password-auth
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
```
|
||
|
|
ip addr | grep en
|
||
|
|
|
||
|
|
cat /etc/pam.d/password-auth | grep pwq
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
达梦：
|
||
|
|
```
|
||
|
|
cd /home/dmdba/dmdbms/bin
|
||
|
|
./disql SYSDBA/'"Hn@dameng123"':35236
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
```
|
||
|
|
SELECT ROLE$ FROM V$DATABASE;
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
```
|
||
|
|
SELECT PARA_NAME, PARA_VALUE
|
||
|
|
FROM V$DM_INI
|
||
|
|
WHERE PARA_NAME='ENABLE_AUDIT';
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
```
|
||
|
|
SP_SET_PARA_VALUE(1, 'ENABLE_AUDIT', 2);
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
```
|
||
|
|
cd /home/dmdba/dmdbms/bin
|
||
|
|
./disql SYSAUDITOR/SYSAUDITOR@localhost:35239
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
```
|
||
|
|
SP_SET_ENABLE_AUDIT(2);
|
||
|
|
SELECT PARA_NAME, PARA_VALUE, PARA_TYPE
|
||
|
|
FROM V$DM_INI WHERE PARA_NAME='ENABLE_AUDIT';
|
||
|
|
|
||
|
|
```
|