Linux Password Similarity Check: How Does It Work?

How Linux Detects Password Similarity

Have you ever been prompted to create a more distinct password due to its resemblance to a previous one? This often sparks curiosity about the underlying mechanisms within your Linux system.

Today we'll explore how Linux identifies passwords that are too similar, offering insight into the processes at work.

Understanding the Mechanism

The ability of a Linux system to recognize password similarity isn't inherent to the operating system itself. Instead, it relies on the PAM (Pluggable Authentication Modules) system.

PAM is a flexible mechanism for authentication, allowing administrators to configure various authentication methods.

The Role of pam_unix

Specifically, the pam_unix module is responsible for handling password changes and enforcing password policies.

Within pam_unix, a crucial component is the password history file, typically located at /var/log/faillog or /var/log/secure.

Password History and Hashing

When you change your password, pam_unix doesn't store the password itself. It stores a cryptographic hash of the password.

Furthermore, it keeps a record of several previous password hashes in the password history file.

Similarity Detection Process

When you attempt to set a new password, pam_unix calculates its hash.

This new hash is then compared to the hashes stored in the password history file.

If the new hash is sufficiently similar to any of the previous hashes, the system flags the password as too similar and prompts you to choose a different one.

Configuration Options

The number of password history entries retained and the sensitivity of the similarity check are configurable.

These settings are typically found in the pam_unix configuration file, often located at /etc/pam.d/common-password.

SuperUser Q&A Source

This explanation originates from a question and answer session on SuperUser, a community-driven Q&A website that is part of the Stack Exchange network.

The original discussion provides further details and insights into this process.

Image credit: marc falardeau (Flickr).

Password Similarity Detection in Linux Systems

A SuperUser user, LeNoob, recently inquired about the mechanism by which Linux systems identify passwords that are overly similar to previous ones.

LeNoob observed that attempting to set a new password closely resembling an existing one resulted in a warning from the operating system.

The Core Question

The central question posed is how the system determines this similarity, given that passwords are typically stored as cryptographic hashes rather than in plain text.

The concern raised is whether the ability to compare password similarity implies that passwords are, in fact, stored as readable text.

How Linux Detects Password Similarity

The operating system does not need to store passwords in plain text to detect similarity.

Instead, Linux systems employ techniques that operate on the password hash itself, or utilize additional data derived from the password during the hashing process.

Methods Used for Similarity Checks

• Salting: A unique random string, known as a salt, is added to each password before hashing.

• Key Stretching: Algorithms like bcrypt, scrypt, or Argon2 are used to slow down the hashing process, making brute-force attacks more difficult.

• History Tracking: Systems often store a history of recent passwords (or their hashes) for each user.

When a user attempts to change their password, the new password is processed using the same salt and key stretching algorithm as before.

The resulting hash is then compared to the hashes in the password history.

Comparing Hashes for Similarity

While directly comparing hashes won't reveal if the passwords are identical, certain algorithms and techniques can detect significant similarity.

For example, even a small change in the password will result in a drastically different hash value when using strong hashing algorithms.

However, if the new password is only slightly different, the resulting hash might share some characteristics with the previous hashes.

Preventing Weak Password Reuse

The goal of these checks is to prevent users from choosing passwords that are easily guessable variations of their previous passwords.

This enhances security by making it more difficult for attackers to compromise accounts, even if they obtain a password hash.

Therefore, the system's ability to flag similar passwords does not indicate that passwords are stored in an insecure, readable format.

Password Security Considerations During Changes

A SuperUser community member, slhck, provides insight into a potential security aspect of password changes.

When utilizing the passwd command, both the existing and new passwords are required, enabling a direct, plain-text comparison of the two.

Although your password is ultimately stored in a hashed format, it remains accessible in plain text within the tool during the input process.

The Role of PAM and pam_cracklib

This functionality is facilitated by the Pluggable Authentication Modules (PAM) system, a standard component of contemporary Linux distributions.

Specifically, the pam_cracklib module within PAM evaluates passwords for potential weaknesses and similarities.

This module doesn't solely focus on passwords that are closely related to one another; it employs a range of checks to assess security.

Password Complexity Checks

The source code of pam_cracklib demonstrates various criteria used for evaluation.

These include identifying palindromic passwords and calculating the edit distance between potential passwords and common words.

The objective of these checks is to enhance password resilience against dictionary-based attacks.

• Password Palindromes: Passwords that read the same backward as forward are flagged.
• Edit Distance: The number of changes needed to transform one word into another is assessed.

Further details regarding pam_cracklib can be found in its manual page.

For a more comprehensive discussion, refer to the original thread on SuperUser, accessible through the link provided below.

We encourage you to contribute your thoughts and insights in the comments section.

Additional perspectives from other knowledgeable Stack Exchange users can be found by exploring the complete discussion thread.