3 ms·
Could something like this be used on headless servers to trigger an alarm that old passwords have been compromised? The typical "root login failed x times" has
by mysterydip 8y ago
Could something like this be used on headless servers to trigger an alarm that old passwords have been compromised? The typical "root login failed x times" has too much noise to be valuable in my experience for anything internet-facing, but looking for specific passwords tried might be useful.
- tyingq 8y agoNot this, but either BSD's auth_userokay() or libpam functionality in Linux would give you access to the cleartext password, which you could compare to whatever hashed history you wanted.
- CodeWriter23 8y agoYes. Put the hash of the old password in the /etc/duress file with a script that pipes to sendmail you@youremail.com. Add one line per old PW you want to monitor and vary the message sent via sendmail to ID which password.
- stevekemp 8y agoI wrote pam_pwnd to deny the use of passwords which have appeared in the have I been pwned database(s): https://github.com/skx/pam_pwnd/ https://github.com/skx/pam_pwnd/ That's not exactly the same thing as denying a previously-valid password, but it is along similar lines.