Feature request: difficult passwords

[BeepingBart]

Dear Directadmin,

This morning, i looked at my network statistics, and found out it was pumping 25mbits/sec since 1am. narrowing it down, i found out it was a perl script which was ddossing a server on the internet.


i've killed the script, and tried to find the leak. i found a user which had a easy to guess password, which they found by checking my server. they abused his account to upload and execute perl scripts.

a couple of month's ago another user had a easy-2-guess password, and his domain was used for running a creditcard site for ebay

could you please implement a option where users are forced to use difficult passwords, with for example:
- a minumum of 6 chars
- capitals and non capitals mixed together
- atleast on of the following chars: !@#$%^&*()):"<> etc etc

if a admin can set this mark for new password changes, this would be perfect, a admin can then choose if he/she wants to use this function

thanks!!!

Bart van de Mosselaar

 

[floyd]

If the script being run is owned or run as the user apache then the problem is not a password vulnerability but a php script vulnerability.

The feature request is still valid but this is just something to check for also.

 

[DirectAdmin Support]

Hello,

I've implemented it for the next release.

Here is the versions system entry for it:
http://www.directadmin.com/features.php?id=910

You can edit the script used to do the checking if you want harder/software enforcement.

It's turned off by default, you have to turn it on in your directadmin.conf file.

If you want it now, send me an email and I'll compile you a binary set to test with.

John

 

[servermgr]

Has anyone implemented this with WHMCS? We can't find where in WHMCS that we set minimum requirements for passwords - especially the enforce_difficult_passwords requirements.

Thanks in advance

 

[floyd]

Has anyone implemented this with WHMCS? We can't find where in WHMCS that we set minimum requirements for passwords - especially the enforce_difficult_passwords requirements.

Thanks in advance

You would need to contact WHMCS for this and ask them to support DirectAdmin's enforce_difficult_passwords.