Remove support for shadow(5)'s sp_min #1482
Conversation
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
It makes no sense to limit the frequency of password change. If one changes its password, and 5 minutes later the password is leaked, one should be able to change the password immediately. Signed-off-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Whenever we were reading it, let's assume it contains a -1 (the integer representation of an empty field). Whenever we were writing it, let's write a -1. Signed-off-by: Alejandro Colomar <alx@kernel.org>
|
The use case for the minimum password age is to prevent lazy people in environments where periodic password changes are required, knowing that they can't reuse 10 last passwords, from changing the password 10 times to throwaway values and then back to the original. In practice, even though it is not explicitly regulated, auditors view it as a part of enforcement of the password history requirement. |
That's actually not lazy people, but intelligent people that know ways of enforcing security even under regulations that actively try them to decrease security.
Auditors can come here and talk with us. :) |
2 participants
Password expiry was deprecated in 4.19.
sp_min(password minimum age) doesn't seem to be regulated, so it seems we can remove it already.Link: #1432