Chapter 7. Defining IdM password policies This chapter describes Identity Management (IdM) password policies and how to add a new password policy in IdM using an Ansible playbook. 7.1. What is a password policy A password policy is a set of rules that passwords must meet. For example, a password policy can define the minimum password length and the maximum password lifetime. All users affected by this policy are required to set a sufficiently long password and change it frequently enough to meet the specified conditions. In this way, password policies help reduce the risk of someone discovering and misusing a user's password. 7.2. Password policies in IdM Passwords are the most common way for Identity Management (IdM) users to authenticate to the IdM Kerberos domain. Password policies define the requirements that these IdM user passwords must meet. Note The IdM password policy is set in the underlying LDAP directory, but the Kerberos Key Distribution Center (KDC) enforces the password policy. Password policy attributes lists the attributes you can use to define a password policy in IdM. Table 7.1. Password Policy Attributes Attribute Explanation Example Max lifetime The maximum amount of time in days that a password is valid before a user must reset it. The default value is 90 days. Note that if the attribute is set to 0, the password never expires. Max lifetime = 180 User passwords are valid only for 180 days. After that, IdM prompts users to change them. Min lifetime The minimum amount of time in hours that must pass between two password change operations. Min lifetime = 1 After users change their passwords, they must wait at least 1 hour before changing them again. History size The number of passwords that are stored. A user cannot reuse a password from their password history but can reuse old passwords that are not stored. History size = 0 In this case, the password history is empty and users can reuse any of their passwords. Character classes The number of different character classes the user must use in the password. The character classes are: * Uppercase characters * Lowercase characters * Digits * Special characters, such as comma (,), period (.), asterisk (*) * Other UTF-8 characters Using a character three or more times in a row decreases the character class by one. For example: * Secret1 has 3 character classes: uppercase, lowercase, digits * Secret111 has 2 character classes: uppercase, lowercase, digits, and a -1 penalty for using 1 repeatedly Character classes = 0 The default number of classes required is 0. To configure the number, run the ipa pwpolicy-mod command with the --minclasses option. See also the Important note below this table. Min length The minimum number of characters in a password. If any of the additional password policy options are set, then the minimum length of passwords is 6 characters. Min length = 8 Users cannot use passwords shorter than 8 characters. Max failures The maximum number of failed login attempts before IdM locks the user account. Max failures = 6 IdM locks the user account when the user enters a wrong password 7 times in a row. Failure reset interval The amount of time in seconds after which IdM resets the current number of failed login attempts. Failure reset interval = 60 If the user waits for more than 1 minute after the number of failed login attempts defined in Max failures , the user can attempt to log in again without risking a user account lock. Lockout duration The amount of time in seconds that the user account is locked after the number of failed login attempts defined in Max failures . Lockout duration = 600 Users with locked accounts are unable to log in for 10 minutes. Important Use the English alphabet and common symbols for the character classes requirement if you have a diverse set of hardware that may not have access to international characters and symbols. For more information about character class policies in passwords, see the Red Hat Knowledgebase solution What characters are valid in a password? . 7.3. Password policy priorities in IdM Password policies help reduce the risk of someone discovering and misusing a user's password. The default password policy is the global password policy . You can also create additional group password policies. The global policy rules apply to all users without a group password policy. Group password policies apply to all members of the corresponding user group. Note that only one password policy can be in effect at a time for any user. If a user has multiple password policies assigned, one of them takes precedence based on priority according to the following rules: Every group password policy has a priority set. The lower the value, the higher the policy's priority. The lowest supported value is 0 . If multiple password policies are applicable to a user, the policy with the lowest priority value takes precedence. All rules defined in other policies are ignored. The password policy with the lowest priority value applies to all password policy attributes, even the attributes that are not defined in the policy. The global password policy does not have a priority value set. It serves as a fallback policy when no group policy is set for a user. The global policy can never take precedence over a group policy. Note The ipa pwpolicy-show --user=user_name command shows which policy is currently in effect for a particular user. 7.4. Ensuring the presence of a password policy in IdM using an Ansible playbook Follow this procedure to ensure the presence of a password policy in Identity Management (IdM) using an Ansible playbook. In the default global_policy password policy in IdM, the number of different character classes in the password is set to 0. The history size is also set to 0. Complete this procedure to enforce a stronger password policy for an IdM group using an Ansible playbook. Note You can only define a password policy for an IdM group. You cannot define a password policy for an individual user. Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. You know the IdM administrator password. The group for which you are ensuring the presence of a password policy exists in IdM. Procedure Create an inventory file, for example inventory.file , and define the FQDN of your IdM server in the [ipaserver] section: Create your Ansible playbook file that defines the password policy whose presence you want to ensure. To simplify this step, copy and modify the example in the /usr/share/doc/ansible-freeipa/playbooks/pwpolicy/pwpolicy_present.yml file: For details on what the individual variables mean, see Password policy attributes . Run the playbook: You have successfully used an Ansible playbook to ensure that a password policy for the ops group is present in IdM. Important The priority of the ops password policy is set to 1 , whereas the global_policy password policy has no priority set. For this reason, the ops policy automatically supersedes global_policy for the ops group and is enforced immediately. global_policy serves as a fallback policy when no group policy is set for a user, and it can never take precedence over a group policy. Additional resources See the README-pwpolicy.md file in the /usr/share/doc/ansible-freeipa/ directory. See Password policy priorities in IdM . 7.5. Adding a new password policy in IdM using the WebUI or the CLI Password policies help reduce the risk of someone discovering and misusing a user's password. The default password policy is the global password policy . You can also create additional group password policies. 7.5.1. Adding a new password policy in the IdM WebUI Password policies help reduce the risk of someone discovering and misusing a user's password. The default password policy is the global password policy . You can also create additional group password policies. Prerequisites A user group to which the policy applies. A priority assigned to the policy Procedure Log in to the IdM Web UI. For details, see Accessing the IdM Web UI in a web browser . Select Policy>Password Policies . Click Add . Define the user group and priority. Click Add to confirm. To configure the attributes of the new password policy, see Password policies in IdM . Additional resources See Password policy priorities in IdM . 7.5.2. Adding a new password policy in the IdM CLI Password policies help reduce the risk of someone discovering and misusing a user's password. The default password policy is the global password policy . You can also create additional group password policies. Prerequisites A user group to which the policy applies. A priority assigned to the policy Procedure Open terminal and connect to the IdM server. Use the ipa pwpolicy-add command. Specify the user group and priority: Optional. Use the ipa pwpolicy-find command to verify that the policy has been successfully added: To configure the attributes of the new password policy, see Password policies in IdM . Additional resources See Password policy priorities in IdM . 7.6. Additional password policy options in IdM As an Identity Management (IdM) administrator, you can strengthen the default password requirements by enabling additional password policy options based on the libpwquality feature set. The additional password policy options include the following: --maxrepeat Specifies the maximum acceptable number of same consecutive characters in the new password. --maxsequence Specifies the maximum length of monotonic character sequences in the new password. Examples of such a sequence are 12345 or fedcb . Most such passwords will not pass the simplicity check. --dictcheck If nonzero, checks whether the password, with possible modifications, matches a word in a dictionary. Currently libpwquality performs the dictionary check using the cracklib library. --usercheck If nonzero, checks whether the password, with possible modifications, contains the user name in some form. It is not performed for user names shorter than 3 characters. You cannot apply the additional password policy options to existing passwords. If you apply any of the additional options, IdM automatically sets the --minlength option, the minimum number of characters in a password, to 6 characters. Note In a mixed environment with RHEL 7 and RHEL 8 servers, you can enforce the additional password policy settings only on servers running on RHEL 8.4 and later. If a user is logged in to an IdM client and the IdM client is communicating with an IdM server running on RHEL 8.3 or earlier, then the new password policy requirements set by the system administrator will not be applied. To ensure consistent behavior, upgrade or update all servers to RHEL 8.4 and later. Additional resources: Applying additional password policies to an IdM group pwquality(3) man page on your system 7.7. Applying additional password policy options to an IdM group Follow this procedure to apply additional password policy options in Identity Management (IdM). The example describes how to strengthen the password policy for the managers group by making sure that the new passwords do not contain the users' respective user names and that the passwords contain no more than two identical characters in succession. Prerequisites You are logged in as an IdM administrator. The managers group exists in IdM. The managers password policy exists in IdM. Procedure Apply the user name check to all new passwords suggested by the users in the managers group: Note If you do not specify the name of the password policy, the default global_policy is modified. Set the maximum number of identical consecutive characters to 2 in the managers password policy: A password now will not be accepted if it contains more than 2 identical consecutive characters. For example, the eR873mUi111YJQ combination is unacceptable because it contains three 1 s in succession. Verification Add a test user named test_user : Add the test user to the managers group: In the IdM Web UI, click Identity Groups User Groups . Click managers . Click Add . In the Add users into user group 'managers' page, check test_user . Click the > arrow to move the user to the Prospective column. Click Add . Reset the password for the test user: Go to Identity Users . Click test_user . In the Actions menu, click Reset Password . Enter a temporary password for the user. On the command line, try to obtain a Kerberos ticket-granting ticket (TGT) for the test_user : Enter the temporary password. The system informs you that you must change your password. Enter a password that contains the user name of test_user : Note Kerberos does not have fine-grained error password policy reporting and, in certain cases, does not provide a clear reason why a password was rejected. The system informs you that the entered password was rejected. Enter a password that contains three or more identical characters in succession: The system informs you that the entered password was rejected. Enter a password that meets the criteria of the managers password policy: View the obtained TGT: The managers password policy now works correctly for users in the managers group. Additional resources Additional password policies in IdM 7.8. Using an Ansible playbook to apply additional password policy options to an IdM group You can use an Ansible playbook to apply additional password policy options to strengthen the password policy requirements for a specific IdM group. You can use the maxrepeat , maxsequence , dictcheck and usercheck password policy options for this purpose. The example describes how to set the following requirements for the managers group: Users' new passwords do not contain the users' respective user names. The passwords contain no more than two identical characters in succession. Any monotonic character sequences in the passwords are not longer than 3 characters. This means that the system does not accept a password with a sequence such as 1234 or abcd . Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package on the Ansible controller. You have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server in the ~/ MyPlaybooks / directory. You have stored your ipaadmin_password in the secret.yml Ansible vault. The group for which you are ensuring the presence of a password policy exists in IdM. Procedure Create your Ansible playbook file manager_pwpolicy_present.yml that defines the password policy whose presence you want to ensure. To simplify this step, copy and modify the following example: Run the playbook: Verification Add a test user named test_user : Add the test user to the managers group: In the IdM Web UI, click Identity Groups User Groups . Click managers . Click Add . In the Add users into user group 'managers' page, check test_user . Click the > arrow to move the user to the Prospective column. Click Add . Reset the password for the test user: Go to Identity Users . Click test_user . In the Actions menu, click Reset Password . Enter a temporary password for the user. On the command line, try to obtain a Kerberos ticket-granting ticket (TGT) for the test_user : Enter the temporary password. The system informs you that you must change your password. Enter a password that contains the user name of test_user : Note Kerberos does not have fine-grained error password policy reporting and, in certain cases, does not provide a clear reason why a password was rejected. The system informs you that the entered password was rejected. Enter a password that contains three or more identical characters in succession: The system informs you that the entered password was rejected. Enter a password that contains a monotonic character sequence longer than 3 characters. Examples of such sequences include 1234 and fedc : The system informs you that the entered password was rejected. Enter a password that meets the criteria of the managers password policy: Verify that you have obtained a TGT, which is only possible after having entered a valid password: Additional resources Additional password policies in IdM /usr/share/doc/ansible-freeipa/README-pwpolicy.md /usr/share/doc/ansible-freeipa/playbooks/pwpolicy

Commands:
[ipaserver] server.idm.example.com
--- - name: Tests hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure presence of pwpolicy for group ops ipapwpolicy: ipaadmin_password: "{{ ipaadmin_password }}" name: ops minlife: 7 maxlife: 49 history: 5 priority: 1 lockouttime: 300 minlength: 8 minclasses: 4 maxfail: 3 failinterval: 5
ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory_/new_pwpolicy_present.yml
ipa pwpolicy-add Group: group_name Priority: priority_level
ipa pwpolicy-find
ipa pwpolicy-mod --usercheck=True managers
ipa pwpolicy-mod --maxrepeat=2 managers
ipa user-add test_user First name: test Last name: user ---------------------------- Added user "test_user" ----------------------------
kinit test_user
Password expired. You must change it now. Enter new password: Enter it again: Password change rejected: Password not changed. Unspecified password quality failure while trying to change password. Please try again.
Password change rejected: Password not changed. Unspecified password quality failure while trying to change password. Please try again. Enter new password: Enter it again:
Password change rejected: Password not changed. Unspecified password quality failure while trying to change password. Please try again. Enter new password: Enter it again:
klist Ticket cache: KCM:0:33945 Default principal: test_user@IDM.EXAMPLE.COM Valid starting Expires Service principal 07/07/2021 12:44:44 07/08/2021 12:44:44 krbtgt@IDM.EXAMPLE.COM@IDM.EXAMPLE.COM
--- - name: Tests hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure presence of usercheck and maxrepeat pwpolicy for group managers ipapwpolicy: ipaadmin_password: "{{ ipaadmin_password }}" name: managers usercheck: True maxrepeat: 2 maxsequence: 3
ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory_/manager_pwpolicy_present.yml
ipa user-add test_user First name: test Last name: user ---------------------------- Added user "test_user" ----------------------------
kinit test_user
Password expired. You must change it now. Enter new password: Enter it again: Password change rejected: Password not changed. Unspecified password quality failure while trying to change password. Please try again.
Password change rejected: Password not changed. Unspecified password quality failure while trying to change password. Please try again. Enter new password: Enter it again:
Password change rejected: Password not changed. Unspecified password quality failure while trying to change password. Please try again. Enter new password: Enter it again:
Password change rejected: Password not changed. Unspecified password quality failure while trying to change password. Please try again. Enter new password: Enter it again:
klist Ticket cache: KCM:0:33945 Default principal: test_user@IDM.EXAMPLE.COM Valid starting Expires Service principal 07/07/2021 12:44:44 07/08/2021 12:44:44 krbtgt@IDM.EXAMPLE.COM@IDM.EXAMPLE.COM