| /freebsd/contrib/pam_modules/pam_passwdqc/ |
| H A D | README | 1 pam_passwdqc is a simple password strength checking module for
2 PAM-aware password changing programs, such as passwd(1). In addition
5 and can be (re-)configured without rebuilding.
7 This module should be stacked before your usual password changing
8 module (such as pam_unix or pam_pwdb) in the password management group
9 (the "password" lines in /etc/pam.d/passwd or /etc/pam.conf). The
10 password changing module should then be told to use the provided new
11 authentication token (new password) rather than request it from the
13 password changing module lacks the "use_authtok" option or its prompts
15 for the old password as well, with "ask_oldauthtok". In that case the
[all …]
|
| H A D | PLATFORMS | 1 Please see the README for instructions common to all platforms and
7 Most modern Linux distributions use Linux-PAM with a password changing
9 module prompts for the old password, things should work either way.
14 As of this writing (April 2002), FreeBSD-current is moving to OpenPAM
16 be for FreeBSD to start actually using PAM from password changing.
23 pam_passwdqc has to ask for the old password during the update phase.
28 not-so-weak passwords with the obsolete "traditional" crypt(3) hashes
|
| H A D | pam_passwdqc.c | 2 * Copyright (c) 2000-2002 by Solar Designer. See LICENSE.
77 "Enter current password: "
79 "Enter new password: "
81 "Re-type new password: "
88 "\nYou can now choose the new password.\n"
90 "\nYou can now choose the new password or passphrase.\n"
92 "A valid password should be a mix of upper and lower case letters,\n" \
94 "password with characters from at least 3 of these 4 classes.\n" \
95 "Characters that form a common pattern are discarded by the check.\n"
97 "A valid password should be a mix of upper and lower case letters,\n" \
[all …]
|
| /freebsd/lib/libpam/modules/pam_passwdqc/ |
| H A D | pam_passwdqc.8 | 1 .\" Copyright (c) 2000-2002 Solar Designer.
8 .\" Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
40 .Nd Password quality-control PAM module
42 .Op Ar service-name
43 .Ar module-type
44 .Ar control-flag
50 module is a simple password strength checking module for
58 password changing.
60 .Ar module-type
62 .Dq Li password
[all …]
|
| /freebsd/contrib/pam-krb5/docs/ |
| H A D | docknot.yaml | 1 # Package metadata for pam-krb5.
10 # Copyright 2017, 2020-2021 Russ Allbery <eagle@eyrie.org>
12 # SPDX-License-Identifier: BSD-3-clause or GPL-1+
16 name: pam-krb5
22 name: BSD-3-clause-or-GPL-1+
24 - holder: Russ Allbery <eagle@eyrie.org>
25 years: 2005-2010, 2014-2015, 2017, 2020-2021
26 - holder: The Board of Trustees of the Leland Stanford Junior University
27 years: 2009-2011
28 - holder: Andres Salomon <dilinger@debian.org>
[all …]
|
| /freebsd/contrib/pam-krb5/ |
| H A D | README.md | 1 # pam-krb5
4 status](https://github.com/rra/pam-krb5/workflows/build/badge.svg)](https://github.com/rra/pam-krb5…
6 package](https://img.shields.io/debian/v/libpam-krb5/unstable)](https://tracker.debian.org/pkg/libp…
8 Copyright 2005-2010, 2014-2015, 2017, 2020-2021 Russ Allbery
9 <eagle@eyrie.org>. Copyright 2009-2011 The Board of Trustees of the
11 <dilinger@debian.org>. Copyright 1999-2000 Frank Cusack
12 <fcusack@fcusack.com>. This software is distributed under a BSD-style
18 pam-krb5 is a Kerberos PAM module for either MIT Kerberos or Heimdal. It
20 handling, authentication of non-local accounts for network services,
21 password changing, and password expiration, as well as all the standard
[all …]
|
| H A D | README | 1 pam-krb5 4.11
5 Copyright 2005-2010, 2014-2015, 2017, 2020-2021 Russ Allbery
6 <eagle@eyrie.org>. Copyright 2009-2011 The Board of Trustees of the
8 <dilinger@debian.org>. Copyright 1999-2000 Frank Cusack
9 <fcusack@fcusack.com>. This software is distributed under a BSD-style
14 pam-krb5 is a Kerberos PAM module for either MIT Kerberos or Heimdal.
16 authorization handling, authentication of non-local accounts for network
17 services, password changing, and password expiration, as well as all the
26 pam-krb5 provides a Kerberos PAM module that supports authentication,
28 checking Kerberos principals against local usernames), and password
[all …]
|
| /freebsd/share/man/man7/ |
| H A D | security.7 | 47 multi-user systems have some inherent security, the job of building and
60 As yesterday's mini-computers and mainframes
74 .Bl -enum -offset indent
89 Typically, DoS attacks are brute-force mechanisms that attempt
99 Brute-force network attacks are harder to deal with.
100 A spoofed-packet attack, for example, is
105 A user account compromise is even more common than a DoS attack.
114 The result is that if you have any moderate-sized user base,
116 (which is the most common an
[all...] |
| /freebsd/stand/forth/ |
| H A D | check-password.4th.8 | 1 .\" Copyright (c) 2011-2018 Devin Teske
29 .Nm check-password.4th
30 .Nd FreeBSD password-checking boot module
36 .Dl o Prevent booting without password
37 .Dl o Prevent modification of boot options without password
38 .Dl o Provide a password to mount geli(8) encrypted root disk(s)
44 examples below for the most common situations, and to
53 .Dl include check-password.4th
57 file, so it is not needed (and should not be re-issued) in a normal setup.
61 .Bl -tag -width disable-module_module -compact -offset indent
[all …]
|
| /freebsd/contrib/wpa/src/utils/ |
| H A D | ext_password_file.c | 2 * External backend for file-backed passwords
11 #include "utils/common.h"
17 * Data structure for the file-backed password backend.
20 char *path; /* path of the password file */
25 * ext_password_file_init - Initialize file-backed password backend
29 * This function initializes a new file-backed password backend. The user is
46 data->path = os_strdup(params); in ext_password_file_init()
47 if (!data->path) { in ext_password_file_init()
57 * ext_password_file_deinit - Deinitialize file-backed password backend
58 * @ctx: The file-backed password backend
[all …]
|
| /freebsd/contrib/wpa/hostapd/ |
| H A D | nt_password_hash.c | 2 * hostapd - Plaintext password to NtPasswordHash
11 #include "common.h"
19 char *password, buf[64], *pos; in main() local
22 password = argv[1]; in main()
25 printf("Failed to read password\n"); in main()
28 buf[sizeof(buf) - 1] = '\0'; in main()
37 password = buf; in main()
40 if (nt_password_hash((u8 *) password, strlen(password), password_hash)) in main()
41 return -1; in main()
|
| /freebsd/contrib/wpa/src/eap_peer/ |
| H A D | eap_otp.c | 2 * EAP peer method: EAP-OTP (RFC 3748)
3 * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
11 #include "common.h"
17 /* No need for private data. However, must return non-NULL to indicate in eap_otp_init()
33 const u8 *pos, *password; in eap_otp_process() local
39 ret->ignore = true; in eap_otp_process()
42 wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-OTP: Request message", in eap_otp_process()
45 password = eap_get_config_otp(sm, &password_len); in eap_otp_process()
46 if (password) in eap_otp_process()
49 password = eap_get_config_password(sm, &password_len); in eap_otp_process()
[all …]
|
| H A D | mschapv2.c | 3 * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
11 #include "common.h"
21 * challenge-response calculation, so remove domain prefix in mschapv2_remove_domain()
27 *len -= i + 1; in mschapv2_remove_domain()
37 const u8 *password, size_t password_len, in mschapv2_derive_response() argument
64 wpa_hexdump_key(MSG_DEBUG, "MSCHAPV2: password hash", in mschapv2_derive_response()
65 password, password_len); in mschapv2_derive_response()
68 password, nt_response) || in mschapv2_derive_response()
70 password, peer_challenge, auth_challenge, in mschapv2_derive_response()
73 return -1; in mschapv2_derive_response()
[all …]
|
| H A D | eap_gtc.c | 2 * EAP peer method: EAP-GTC (RFC 3748)
3 * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
11 #include "common.h"
27 if (sm->m && sm->m->vendor == EAP_VENDOR_IETF && in eap_gtc_init()
28 sm->m->method == EAP_TYPE_FAST) { in eap_gtc_init()
29 wpa_printf(MSG_DEBUG, "EAP-GTC: EAP-FAST tunnel - use prefix " in eap_gtc_init()
31 data->prefix = 1; in eap_gtc_init()
50 const u8 *pos, *password, *identity; in eap_gtc_process() local
57 ret->ignore = true; in eap_gtc_process()
62 wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-GTC: Request message", pos, len); in eap_gtc_process()
[all …]
|
| H A D | eap_md5.c | 2 * EAP peer method: EAP-MD5 (RFC 3748 and RFC 1994)
3 * Copyright (c) 2004-2012, Jouni Malinen <j@w1.fi>
11 #include "common.h"
18 /* No need for private data. However, must return non-NULL to indicate in eap_md5_init()
34 const u8 *pos, *challenge, *password; in eap_md5_process() local
38 password = eap_get_config_password(sm, &password_len); in eap_md5_process()
39 if (password == NULL) { in eap_md5_process()
40 wpa_printf(MSG_INFO, "EAP-MD5: Password not configured"); in eap_md5_process()
42 ret->ignore = true; in eap_md5_process()
48 wpa_printf(MSG_INFO, "EAP-MD5: Invalid frame (pos=%p len=%lu)", in eap_md5_process()
[all …]
|
| /freebsd/crypto/krb5/src/windows/leash/htmlhelp/html/ |
| H A D | Password_Tips.htm | 1 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
6 <Title>Password Tips</Title>
10 <H1>Password Tips and Examples</H1>
12 …password cracking generators have gotten better as well. A password cracking program can rapidly t…
14 <H3>Good Password Requirements</H3>
16 A strong password: </p>
23 <H3>Password Advice and Examples</H3>
25 …password that is still easy to remember, try starting with a phrase or sentence. Then play around …
32 <H3>What Makes a Bad Password</H3>
34 Do <b>not</b> base your password on any of the following. They are far too easy to guess (even if y…
[all …]
|
| /freebsd/contrib/wpa/src/pasn/ |
| H A D | pasn_common.c | 2 * PASN common processing
12 #include "utils/common.h"
13 #include "common/wpa_common.h"
14 #include "common/sae.h"
17 #include "common/ieee802_11_defs.h"
47 pasn->cb_ctx = cb_ctx; in pasn_register_callbacks()
48 pasn->send_mgmt = send_mgmt; in pasn_register_callbacks()
49 pasn->validate_custom_pmkid = validate_custom_pmkid; in pasn_register_callbacks()
57 pasn->derive_kdk = true; in pasn_enable_kdk_derivation()
58 pasn->kdk_len = WPA_KDK_MAX_LEN; in pasn_enable_kdk_derivation()
[all …]
|
| /freebsd/usr.sbin/bsdconfig/password/share/ |
| H A D | password.subr | 3 # Copyright (c) 2012-2013 Devin Teske
31 . $BSDCFG_SHARE/common.subr || exit 1
32 f_dprintf "%s: loading includes..." password/password.subr
35 BSDCFG_LIBE="/usr/libexec/bsdconfig" APP_DIR="040.password"
42 # Prompt the user to enter a password (twice). If the user does not cancel or
43 # press ESC, the $pw_password environment variable will hold the password.
68 # Loop until the user provides taint-free/valid input
73 --title "$DIALOG_TITLE" \
74 --backtitle "$DIALOG_BACKTITLE" \
75 --hline "$hline" \
[all …]
|
| /freebsd/contrib/openpam/doc/man/ |
| H A D | pam.man | 3 of common authentication-related operations and provides a framework
22 session management and password management.
58 functions manage named chunks of free-form data, generally used by
70 function enforces policies such as password expiry, account expiry,
71 time-of-day restrictions, and so forth.
78 .Ss Password Management
81 function allows the server to change the user's password, either at
82 the user's request or because the password has expired.
|
| /freebsd/crypto/heimdal/doc/ |
| H A D | setup.texi | 21 * Password changing::
26 * Credential cache server - KCM::
32 * Setting up PK-INIT::
48 @samp{[@samp{section-name}]}. A binding consists of a left hand side, an equal sign
51 @samp{@{} as the first non-whitespace character after the equal sign. All
57 a-subsection = @{
59 other-var = value with @{@}
60 sub-sub-section = @{
70 separated by slashes (@samp{/}). The @samp{other-var} variable will thus
71 be @samp{section1/a-subsection/other-var}.
[all …]
|
| /freebsd/stand/defaults/ |
| H A D | loader.conf.5 | 52 .Bl -bullet
75 All such settings sharing a common
77 .Bl -tag -width Ar
101 .Dq Li -1 ,
128 Set to "yes" to get the same effect as boot -v or booting verbose from the
145 The lua-based loader will process files with a
156 should be treated as write-only.
179 .Bd -literal
188 .Bl -bullet -compact
232 .It Ar password
[all …]
|
| /freebsd/usr.sbin/bsdinstall/scripts/ |
| H A D | rootpass | 2 #-
30 . $BSDCFG_SHARE/common.subr || exit 1
32 if [ -n "$ROOTPASS_ENC" ]; then
33 printf '%s\n' "$ROOTPASS_ENC" | pw -R $BSDINSTALL_CHROOT usermod root -H 0
35 elif [ -n "$ROOTPASS_PLAIN" ]; then
36 printf '%s\n' "$ROOTPASS_PLAIN" | pw -R $BSDINSTALL_CHROOT usermod root -h 0
46 echo "The password cannot be empty"
92 output=$(bsddialog --backtitle "$OSNAME Installer" \
93 --title "Set $username password" \
94 --cancel-label "Skip" \
[all …]
|
| /freebsd/crypto/heimdal/lib/krb5/ |
| H A D | krb5_get_in_cred.3 | 47 Kerberos 5 Library (libkrb5, -lkrb5)
88 .Fa "const char *password"
142 If your need is only to verify a user and password, consider using
170 uses the clients password to authenticate.
171 If the password argument is
173 the user user queried with the default password query function.
184 There are some common arguments to the krb5_get_in functions, these are:
205 terminated array of pre-authentication types.
210 the function will try without pre-authentication and return those
211 pre-authentication that the KDC returned.
[all …]
|
| /freebsd/contrib/wpa/src/eap_server/ |
| H A D | eap_server_gtc.c | 2 * hostapd / EAP-GTC (RFC 3748)
3 * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
11 #include "common.h"
28 data->state = CONTINUE; in eap_gtc_init()
31 if (sm->m && sm->m->vendor == EAP_VENDOR_IETF && in eap_gtc_init()
32 sm->m->method == EAP_TYPE_FAST) { in eap_gtc_init()
33 wpa_printf(MSG_DEBUG, "EAP-GTC: EAP-FAST tunnel - use prefix " in eap_gtc_init()
35 data->prefix = 1; in eap_gtc_init()
57 msg = data->prefix ? "CHALLENGE=Password" : "Password"; in eap_gtc_buildReq()
63 wpa_printf(MSG_ERROR, "EAP-GTC: Failed to allocate memory for " in eap_gtc_buildReq()
[all …]
|
| /freebsd/usr.sbin/pw/ |
| H A D | pw.8 | 174 utility is a command-line based editor for the system
195 password database files, and must be run as root
235 The following flags are common to most or all modes of operation:
236 .Bl -tag -width "-G grouplist"
244 Set an alternate location for the password, group, and configuration files.
270 command-line options, it may be more convenient to keep standard information in a
310 will concurrently update it with the system password
319 .Bl -tag -width "-G grouplist"
366 .Bl -tag -width "-G grouplist"
369 which normally contains up to four comma-separated fields containing the
[all …]
|