Which PAM module checks new passwords against dictionary words and enforces complexity?

Which PAM module checks new passwords against dictionary words and enforces complexity?

• A. pam_unix
• B. pam_string
• C. pam_cracklib
• D. pam_tally

Answer: (C)

The PAM module that checks new passwords against dictionary words and enforces complexity is pam_cracklib. This module enhances security by ensuring that passwords are not only complex but also not easily guessable based on commonly used words. It evaluates the strength of passwords by referencing a dictionary file, which contains commonly used words and phrases, and will reject passwords that are too simple or predictable. In addition to checking against dictionary words, pam_cracklib can enforce rules such as requiring a mix of different character types (uppercase, lowercase, numbers, special characters) and setting minimum length requirements. This makes passwords significantly harder for attackers to crack using dictionary or brute-force attacks. Other modules, such as pam_unix, primarily handle traditional UNIX-style password authentication without the added complexity checks offered by pam_cracklib. Pam_string is generally used for string comparisons in authenticating passwords, and pam_tally is focused on tracking login attempts rather than enforcing password complexity. Thus, pam_cracklib specifically addresses the need for enforcing strong and complex password creation, which is critical in maintaining system security.

The PAM module that checks new passwords against dictionary words and enforces complexity is pam_cracklib. This module enhances security by ensuring that passwords are not only complex but also not easily guessable based on commonly used words. It evaluates the strength of passwords by referencing a dictionary file, which contains commonly used words and phrases, and will reject passwords that are too simple or predictable.

In addition to checking against dictionary words, pam_cracklib can enforce rules such as requiring a mix of different character types (uppercase, lowercase, numbers, special characters) and setting minimum length requirements. This makes passwords significantly harder for attackers to crack using dictionary or brute-force attacks.

Other modules, such as pam_unix, primarily handle traditional UNIX-style password authentication without the added complexity checks offered by pam_cracklib. Pam_string is generally used for string comparisons in authenticating passwords, and pam_tally is focused on tracking login attempts rather than enforcing password complexity. Thus, pam_cracklib specifically addresses the need for enforcing strong and complex password creation, which is critical in maintaining system security.