A PAM module to test SSH/SUDO passwords against HaveIBeenPwnd

Re:A PAM module to test SSH/SUDO passwords against HaveIBeen... by LinuxBender on Monday September 17, 2018 @10:57AM (#18006491)

Fair enough :-) Would it be feasible to add something in the module that could optionally send a string to the user to say that some portion of a hash of their pw will be verified against that API?

I am thinking of the cases where a security org enables this on a jump box, but only sends an email that gets lost among the myriad of other emails that people do not read. It would be great if there was a banner that could be sent to make privacy and compliance teams happier.

[ Parent | on HN ]

Re:A PAM module to test SSH/SUDO passwords against HaveIBeen... by stevekemp on Monday September 17, 2018 @12:58PM (#18007673)

It wouldn't be impossible, but when I think of the automated-tools that would drive sudo I'm wary of producing unexpected output by default.

I would guess that the kind of org that wanted this would probably be using some kind of automation so they could issue the notification via /etc/issue, /etc/issue.net, or similar central fashion.

Maybe I'm optimistic!

[ Parent | on HN ]