Kerberos: The Definitive Guide

Heimdal

The Heimdal KDC does not include any password strength-checking code by default. Instead, it only enforces a password minimum of six characters. To perform more stringent password strength checks, Heimdal provides a powerful method to link in an external library in order to verify the strength of user-provided passwords. While this method is powerful, since any external function can be provided to check password strength, it is much harder to set up than the built-in capabilities available in the other KDCs.

In the latest version of the Heimdal KDC, a sample password-check function is available in the source distribution. It uses the freely available cracklib to verify passwords against commonly used passwords and other identifiers. To use this password-checking function, obtain cracklib from http://www.users.dircon.co.uk/~crypto/. Once you’ve built cracklib, the function is located in lib/kadm5/sample_passwd_check.c. This file must be built into a shared library; the exact command varies depending on your system and compiler, but a sample would be:

gcc -shared  -o sample_passwd_check.so sample_passwd_check.c -lcracklib

Once the shared library is built, add the following lines in your /etc/krb5.conf file to enable the password checking:

[password_quality]
        check_library = path to sample_passwd_check.so
        check_function = check_cracklib

When you restart kpasswdd, the password checking is enabled.