Password complexity rules

[Rod MacPherson]

Hi, I just read about the new fedora project password change, and the thing that caught my attention is your interesting password complexity rules. 9 char if using upper, lower, numbers and special chars, 20 chars otherwise. 

I have never seen this type of complexity rule in action before, so the first thing that sprung to my mind is "what PAM plugins are they using to accomplish this, and where can I get that?" 

I'm sure other security professionals would love to try this, but the standard modules in most Linux distros only allow very simple min length, min complexity settings, not an if complexity >= this, min_length == min1, else min_length == min2

I'd like to do a write-up about this for infosecisland.com which can include an interview with someone at fedoraproject if you like, but doesn't have to.


Rod MacPherson, CISSP, CISA, C|EH
rod at macphersonclan.com
www.infosecisland.com