PAM password manager configuration options

Last Updated : Jun 15, 2021 |

Existing global password configuration (etc/login.defs)

Name

Description

PASS_MAX_DAYS

The global setting for the maximum number of days a password is valid. The PASS_MAX_DAYS value is specified in the etc/login.defs file.

This field is read-only.

PASS_MIN_DAYS

The global setting for the minimum number of days allowed before the next password change. The PASS_MIN_DAYS value is specified in the etc/login.defs file.

This field is read-only.

PASS_WARN_AGE

The global setting for the number of days the user gets a warning before password expiry. The PASS_WARN_AGE value is specified in the etc/login.defs file.

This field is read-only.

New global password configuration (etc/login.defs)

Name

Description

Maximum number of days a password may be used (PASS_MAX_DAYS)

The number of days during which a password is valid.

The value range is -1 through 99999.

The value of -1 indicates that the password never expires.

Minimum number of days allowed between password changes (PASS_MIN_DAYS)

The minimum number of days allowed between password changes.

The value range is 0 through 99999.

Number of days warning given before a password expires (PASS_WARN_AGE)

The number of days before the user gets a password expiry warning message.

The value range is 0 through 99999.

Optional Additional Authentication Protocols

Name

Description

Enable EASG user access

The users are authenticated using Enhanced Access Security Gateway (EASG). You can configure authentication settings using the sroot and craft check boxes.

If EASG is enabled during the installation, the check box is selected by default. If either sroot or craft check boxes are selected, they are automatically cleared when you clear the Enable EASG user access check box. You can remove EASG from the system only from the command line.

External LDAP

To determine if an external LDAP server manages user authentication.

By default, this check box is cleared.

Password Limits

Name

Description

Enforce Password Limits

To determine whether to enable password limits.

By default, this check box is selected.

Number of times user is prompted for a new password (retry)

The number of times that the AE Services management console prompts a user to retry a password entry.

The value range is 0 through 50. The default value is 3.

Modifying this value affects the Add Login and Modify Login settings on the Account Management subtab.

Number of characters in new password that must be different from old password (difok)

The number of characters in the new password that must be different from the old password.

The value range is 0 through 50. The default value is 2.

Modifying this value affects the Add Login and Modify Login settings on the Account Management subtab.

Minimum length of a new password (minlen)

The minimum number of characters in a password.

The value range is 0 through 50. The default value is 14.

Modifying this value affects the Add Login and Modify Login settings on the Account Management subtab.

Minimum number of digits required in a new password (dcredit)

The minimum number of digits required in a password. The default value is 0.

Minimum number of upper case letters required in a new password (ucredit)

The minimum number of uppercase characters required in a password. The default value is 0.

Minimum number of lower case letters required in a new password (lcredit)

The minimum number of lowercase characters required in a password. The default value is 0.

Minimum number of other characters required in a new password (ocredit)

The minimum number of special characters required in a password. The default value is 0.

AE Services supports a US standard keyboard.

You cannot use the following characters:

  • $ (dollar sign)

  • ’ (apostrophe)

  • " (quotation mark)

  • \ (backslash)

  • Space

  • Any ASCII character

Number of previous passwords that cannot be reused

The number of previous passwords that you cannot reuse. The default value is 10.

Maximum same consecutive characters in a password (maxrepeat)

The maximum number of identical consecutive characters in the password. The default value is 2.

Maximum consecutive characters from the same character class (maxclassrepeat)

The maximum number of consecutive characters from the same character class. The default value is 4.

Password encrypt algorithm

The encryption algorithm for a password.

The options are:

  • sha256

  • sha512 (Default)

Failed Login Response

Name

Description

Enable account lock out with the following parameters

To enable account lockout with the parameters specified in the Failed Login Response section.

By default, this setting is disabled.

Lock out login after <x> unsuccessful attempts to login (deny)

The number of unsuccessful attempts the user can try to log in before the account is locked.

The default value is 5.

Lock account for <x> seconds (lock_time)

The time in seconds during which the account is locked.

The default value is 600.