Lion Cipher Lab
Set a strong password policy with PAM on your own Linux machine
- Identity & Access Management
- Intermediate
- ~60-75 min
- Free · no account required
Why it matters
Almost every intrusion that does not involve a fresh software flaw begins the same dull way: someone logs in with a password an attacker guessed, reused, or found in a leak. A password policy is the set of rules that makes that far harder -- how strong a password has to be before the system will accept it, how long it can be used before it must change, and how many wrong guesses an attacker gets before the account slams shut. On Linux, all three of those rules are enforced in one place: PAM, the Pluggable Authentication Modules framework that every login, `sudo`, and `passwd` on the system…
What you'll learn
- what PAM (Pluggable Authentication Modules) is and where its config lives
- backing up config files before you edit them, the safe reversible way
- setting password complexity with pam_pwquality (minlen, credits, minclass)
- TESTING that a weak password is actually refused, not just assumed
- setting password aging with chage and the login.defs defaults
- adding account lockout after failed logins with pam_faillock
- testing lockout and unlocking an account with the faillock tool
- keeping a root/rescue session open so you never lock yourself out
- reading real man pages (pam_pwquality, faillock.conf, chage) as the authority
- matching your policy to modern guidance (NIST SP 800-63B): length over forced complexity
Steps in this lab
- First: do this on a machine you can afford to break, and keep a rescue session open
- Get a free, throwaway Linux environment to practice on (from nothing)
- Open a terminal, set up your rescue session, and meet PAM
- Password complexity: configure pam_pwquality
- TEST it: prove a weak password is actually refused
- Password aging: set expiry and change intervals with chage
- Account lockout: configure pam_faillock
- TEST the lockout, then unlock -- with your rescue rope tied
- Reality check: match your policy to modern guidance (NIST 800-63B)
- Clean up, make it a habit, and where to take this next