2-3. How to use each command properly

The following can be summarized as described above. The next chapter explains how to use pwmake and pwgen.

• ** pwmake ** is suitable for generating OS login password on RHEL7 or later or Ubuntu.
• ** pwgen ** is suitable for generating passwords that do not limit usage

3. Use pwgen

Explains how to use the general-purpose password generation command pwgen.

3-1. Install pwgen

pwgen is provided by the EPEL repository. However, it may be included in the standard repository for public cloud OS images. I will explain each of RHEL and Ubuntu.

** RHEL system **

1. Make sure pwgen is installed.

$ rpm -qa | grep pwgen
★ Nothing is displayed when it is not installed.

2. If it is not installed, check if it is included in the existing repository.

$ sudo yum provides pwgen
★ When No matches is displayed, it is not included in the repository.
No matches found

★ The package name is displayed when it is included in the repository.
pwgen-2.08-1.el7.x86_64 : Automatic password generation
Repo        : epel

3. If it is not included in the existing repository, install the EPEL repository first. For details on EPEL, refer to "I tried to summarize how to use the EPEL repository again".

#RHEL6 series
sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm -y

#RHEL7 series
sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm -y

#RHEL8 series
sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm -y

# Amazon Linux 2
sudo amazon-linux-extras install epel

4. Install pwgen.

$ sudo yum install pwgen -y

** Ubuntu series **

$ sudo apt install pwgen

3-2. How to execute pwgen

The grammar of pwgen is as follows. Specify the password length and number after the option. For options other than the following, refer to man.

grammar

pwgen [ OPTIONS ] [ pw_length ] [ num_pw ]

** Example 1) ** Password length is 12 characters, including at least one uppercase letter (-c) and number (-n). If you do not specify the number, the full screen is displayed as shown below. You can choose the one you want to use from these.

$ pwgen -c -n 12
Eiv5roo5pha1 ahnie0Zeogh2 piedu8Vaijoo Foa2eghiiPho teiHosoh8ooF ohgh0Ohwaesh
pahph6Aiyu0M leiB2xahlah1 maePee7fonoe aeGo6xielaeM Veif1Iaj4Na7 beiB8IKungie
Ohlah2aithak Aelaelo2ieri bieRef8ceire cahxu7AF4Ung chah7Aht6vah edeva9Ooquie
gaeWo1Aijae7 ii1AeThuewei oohaeW0nahm5 ohmoot7Ia6Du pho0vooW4eet cu3eeThioKu9
★ Omitted below

** Example 2) ** Password length is 12 characters, including at least one uppercase letter (-c), number (-n), symbol (-y), and no confusing characters (-B). Generate 5 with 1 password (-1) per line.

$ pwgen -c -n -y -B -1 12 5
ashoo3ga(M3W
goo7ke\o4aeL
beiHae4voeH.
AJ3ok3ahj{in
shoo7ExiJ"ir

4. Use pwmake

** pwmake ** is a command closely related to OS password authentication, and can generate passwords according to the OS password policy without specifying options.

Whereas ** pwgen ** is a single command, ** pwmake ** is included in the pam_pwquality (libpwquality) module used in RHEL7. Therefore, understanding pam_pwquality is indispensable for understanding pwmake, so I will explain it first.

4-1. What is pam_pwquality?

pam_pwquality is a PAM module that enforces password policies such as "mixed case, password of ○ characters or more is required". When the passwd command is executed, the password is evaluated in the following order and can be set only when it is satisfied.

• Dictionary check
• Rule check in configuration file /etc/security/pwquality.conf

Describe the two important pam_pwquality files /etc/pam.d/system-auth and/etc/security/pwquality.conf.

The PAM module that checks passwords depends on the version and type of Linux. See the link below for details.

RHEL7 or later: pam_pwquality RHEL6：pam_cracklib Ubuntu: pam_unix. pam_pwquality is also available as an option 　　　→Enforce Password Complexity Policy On Ubuntu 18.04

4-1-1. /etc/pam.d/system-auth

This file is the PAM module definition file, and pam_pwquality is the caller. Since there are some lines that are not related to this explanation, I will introduce the grep one.

The default when installing from the media is as follows. It may be customized in the cloud.

# grep ^password /etc/pam.d/system-auth
password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

In the following example, the pam_pwhistory module is also used to prevent password reuse the past N times.

Customization example

password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= enforce_for_root
password    requisite     pam_pwhistory.so use_authtok enforce_for_root remember=4
password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok enforce_for_root remember=4
password    required      pam_deny.so

** Reference: RHEL6 series example ** RHEL6 series uses pam_cracklib instead of pam_pwquality. The password policy is specified inline in /etc/pam.d/system-auth as shown below, not in the configuration file described later.

RHEL6 series

password    requisite     pam_cracklib.so retry=3 minlen=8 difok=3 gecoscheck ocredit=-1 dcredit=-1 ucredit=-1 lcredit=-1 enforce_for_root

4-1-2. /etc/security/pwquality.conf

/etc/security/pwquality.conf is a configuration file that defines password rules. In RHEL8 series, it may be /etc/security/pwquality.conf.d/pwquality.conf. This is also a long file, so I will introduce the grep one.

# grep -v -e '^\s*#' /etc/security/pwquality.conf

When I installed from the media, everything was commented out, so when I grep it, nothing is displayed.

Example of all commented out

# Number of characters in the new password that must not be present in the
# old password.
# difok = 5
#
# Minimum acceptable size for the new password (plus one if
# credits are not disabled which is the default). (See pam_cracklib manual.)
# Cannot be set to lower value than 6.
# minlen = 9
★ Omitted below

Default values are set in many clouds, and in Oracle Cloud Infrastructure Compute they are set as follows: I wrote the meaning briefly, but please refer to the comment and man in the configuration file for details.

difok = 3       #Last 3 passwords not available
minlen = 8      #Password must be 8 characters or more
dcredit = -1    #One or more numbers
ucredit = -1    #One or more uppercase letters
lcredit = -1    #At least one lowercase alphabet
ocredit = -1    #One or more symbols
gecoscheck = 1  # /etc/Does not contain words in the GECOS field of the passwd entry

4-2. How to execute pwmake

The introduction is long, but let's generate a password with pwmake. Specify the number of entropy bits as follows. The simple representation of the number of entropy bits is the difficulty of decoding. You can specify more than 56 numbers, and 64 is often sufficient.

grammar

pwmake <number of entropy bits>

pwmake generates a password considering both "pam_pwquality setting value" and "entropy bit number". If there is no value in the configuration file, only "the number of entropy bits" is considered. Looking at the following example, the larger the number of entropy bits, the longer the password.

$ pwmake 56
YKHUdiLIj$AH
$ pwmake 64
dEHimAf3PIwUgG
$ pwmake 80
iczaf0D4x@M-EhEGt
$ pwmake 128
Yc4kexIJiw5@sIDM3R6an(ijEDYM

The following example is run on Oracle Cloud Infrastructure Compute. It reflects the contents of the definition file and contains uppercase letters, numbers, symbols, etc. If you don't like it, you can do it multiple times.

$ pwmake 64
ErODFOROJ0w+YN

In other words, it can be said to be a very convenient command when there is a definition in the configuration file like the public cloud. Also, if there is no definition, you can generate a strong password, depending on your luck, such as uppercase / lowercase letters and numbers.

• man pwmake
• man pam_pwquality
• man pwquality.conf

5. Summary

• ** pwgen is a versatile password generation command **
• ** pwmake is a password generation command that is installed by default on RHEL7 and later. Useful when generating a password that conforms to the OS password policy **

You might think it's an OS login password now, but VNC and xrdp are the main triggers. Password login is also required in the cloud to use these.

Also, for serial console connections of Oracle Cloud Infrastructure and Azure VM, it is necessary to set a password for the OS user.

You can use your own strong passwords, but why not use these commands as a way to generate strong passwords without much thought?