pam_havebeenpwned

This PAM security module integrates the IHaveBeenPwned API (https://haveibeenpwned.com/) written by @Troy Hunt into PAM. Every time a user types a new password, a call to the API is made. If the password has been pwned, the module returns PAM_AUTHOK_ERR and the password is not changed.

This module leverages their K-Anonymity password database (https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity)

Build & Install

• Install the pre-requisites first:

  apt-get install libssl-dev libcurl4-openssl-dev libpam-dev

• Then, build & install the module:

  git clone https://github.com/nonamed01/pam_havebeenpwned.git
  cd pam_havebeenpwned
  make
  su -c "make install"

• Enable the module automatically by running pam-auth-update (see below) or, alternatively, you can do it by hand:

• Edit /etc/pam.d/common-passwd and add the following line BEFORE the first pam_unix.so entry:

  password requisite pam_havebeenpwned.so [options]

• Append "try_first_pass" to the first pam_unix.so entry, so that the line right beneath the pam_havebeenpwned.so entry looks like this:

  password [success=1 default=ignore] pam_unix.so obscure sha512 try_first_pass

Automatic configuration using pam-auth-update

Run:

pam-auth-update

And enable the module using the ncurses-gui interface as shown here:

The priority for this module is calculated according to https://wiki.ubuntu.com/PAMConfigFrameworkSpec.
By default, these are the enabled module options (see Module options):

• minlen=8
• seen
• timeout=20
• enforceonerror

Updating

cd pam_havebeenpwned
git pull
make
pam-auth-update and disable the module
su -c "make install"

Documentation

run:

man pam_havebeenpwned

Example of /etc/pam.d/common-password on a Debian system

password requisite pam_havebeenpwned.so minlen=8
password [success=1 default=ignore] pam_unix.so obscure sha512 try_first_pass
password requisite pam_deny.so
password required pam_permit.so
password optional pam_gnome_keyring.so

Module options

* debug.		If set, you will get debugging messages through /var/log/auth.log

* minlen.		The minimum password length. By default, 6 characters (hard-coded).

* seen.			If set, it will print the number of times this password has been seen. 

* timeout.		The total number of seconds until CURL aborts the request. Default: 10s.

* enforceonerror.	 If set, whenever an error occurs communicating with the API (Network
			 errors, API errors, and so on) the module returns PAM_AUTHTOK_ERR and exits.

EXAMPLES:

password requisite pam_havebeenpwned.so minlen=8 debug  
password requisite pam_havebeenpwned.so minlen=12 seen
password requisite pam_havebeenpwned.so minlen=12 timeout=20 seen debug enforceonerror

Screenshot