Daddio has asked for the wisdom of the Perl Monks concerning the following question:

I am looking for a module or routine that will help me determine if a user's "new password" meets, say, UNIX or Kerberos standards (minimum six chars, more than one character class, etc.). The project on which I am working cannot use standard UNIX "passwd" type commands. I haven't seen this in CPAN or in other posts here. Any ideas? Thanks.

Replies are listed 'Best First'.
Re: Password Format Checking
by Masem (Monsignor) on Feb 19, 2001 at 19:51 UTC
    Well, regex is powerful enough to decide if a password fails:

    Not less than 6 characters: /\S{6,}?/

    More than one character class: (/[a-zA-Z]/ && /[0-9]/ && /[!@#]/) (that last one is only a subset of what you could include)

    You can also do the standard 'flip' through the /usr/dict for common words. (eg while (<DICT>) { if ($password =~ /$_/) { $flag = 1; last; } }).

    But there doesn't seem to be any module for it. I think this is because the typical passwd program can vary from system to system depending on installation, distribution, and end-use security features.

[reply]
[d/l]
[select]
      Thanks for the responses. I didn't think I would need a module, but figured I would ask instead of "reinventing the wheel," just in case. Thanks again!
[reply]
Re: Password Format Checking
by arturo (Vicar) on Feb 19, 2001 at 20:48 UTC

    Hmmm, it's a little old, but Crypt::Cracklib appears to do what you want (dollars to donuts, as I say when I feel like annoying people, though, one needs cracklib installed to use it, since it's billed as an 'interface to' cracklib).

    Philosophy can be made out of anything. Or less -- Jerry A. Fodor

[reply]
Re: Password Format Checking
by TheoPetersen (Priest) on Feb 19, 2001 at 20:33 UTC
    Are you on a system that uses PAM? If so, Authen::Pam could be what you need. It claims to run on Linux, Solaris and FreeBSD.
[reply]
      Nope, I think that Authen::Pam provides an interface to the PAM library, which is a library for providing alternative authentication (eg smart cards)
      --

      Zigster
[reply]
        Err, no. PAM is a layer on various forms of authentication, from Unix passwd and shadow files to distributed systems like Kerberos. Application developers like PAM because it frees applications from (most) knowledge of how authentication is done.

        Here is the FAQ for the Perl interface.

        That said, arturo's solution is probably better for Daddio's actual question, but Authen::PAM is a good choice for Perl apps that need to authentication services.

[reply]

Back to Seekers of Perl Wisdom