pam_pwnd

> I have seen experienced sysadmins create the test user with the password of "test" on a live server on port 22 because they were having an "autopilot moment". pam_pwnd[1], testing passwords against the Pwned Passwords database, is a(n unfortunately abandoned but credibly feature complete) thing. (It uses the HTTP service, though, not a local dump.) [1] https://github.com/skx/pam_pwnd

> If the user has a super secure password shared with a different, compromised service, libcrack will not detect that. There's a module[0] for that (TM). > Expiry results in passwords like: (prefix)Dec2020, (prefix)5 libcrack can enforce similarity and rotation checks too [1]. > or cycling the last 2/3 entries. There's also another module[2] just for that. > Keys can be relatively easily revoked and are guaranteed not guessable. You're right but, a good password policy and infrastructure is not a simple straw man which can be set alight with a simple match. PAM can be a bit hard to understand but, once understood, it's pretty easy to create complex rules and flows. If you get your workstation compromised somehow, you can always lose your keys. Then you need another password on top of your key to keep it encrypted. At the end of the day, a

I got a notification today that my domain has been included in this collection. But as far as I can see it is gibberish spam-mails. I see 500+ entries such as: fkdsjlfjldsf@example.com spamkdsjf31@example.com fsdjlfsdjkl@example.com i.e. None of these emails at my domain are real, nor have they ever been real. That said if you allow password-based authentication on a server which is shared you might consider using my PAM module: https://github.com/skx/pam_pwnd It does lookups of previously-leaked passwords. Best practice these days is SSH-keys for authentication, but this would cover weak sudo passwords too, etc.

I wrote pam_pwnd to deny the use of passwords which have appeared in the have I been pwned database(s): https://github.com/skx/pam_pwnd/ That's not exactly the same thing as denying a previously-valid password, but it is along similar lines.