News for hackers. Stuff that matters.

A comment on Linux Hardening Guide. Parent comment

Re:Linux Hardening Guide by oblio on Thursday December 31, 2020 @12:42PM (#25594902)
> libcrack can enforce similarity and rotation checks too [1].

How can it do that without the server storing plain text passwords?

[ Parent | on HN ]
Re:Linux Hardening Guide by bayindirh on Thursday December 31, 2020 @01:35PM (#25595554)
Unless you're root, you enter your current password first for verification already?
[ Parent | on HN ]
Re:Linux Hardening Guide by oblio on Thursday December 31, 2020 @01:44PM (#25595656)
Ah, ok, that makes a lot more sense. I was worried that the password history was stored somewhere.

> Unless you're root

I'm not sure I get this part, why does being root change things?

[ Parent | on HN ]
Re:Linux Hardening Guide by bayindirh on Thursday December 31, 2020 @02:24PM (#25596132)
Normally PAM doesn’t ask for your current password during password changes if you’re root.

Also, root can change any user’s password without entering the current one.

[ Parent | on HN ]