goodpw -- check a password for non-obviousness


goodpw [ -absm ] [ -d file ] [ -r reason ] [ -MR expr ]


goodpw reads a proposed password from the standard input and applies a variety of heuristic checks intended to spot poor password choices. These checks can include checking against user names, English words, and too short or too simple passwords. The checks applied depend on the settings in /etc/default/goodpw, the file specified by the -d option, and the expressions specified by the -M and -R options.

The first line read from the standard input is taken to be the proposed password. A list of ``canonical forms'' is then generated; the canonical form is the password without any non-letters and with all letters converted to upper-case. The list always includes the canonical form of the password and may, depending on the settings in /etc/default/goodpw, also contain left or right ``rotations'' of the canonical form. A rotation to the left is a shifting of the second through last character one position to the left, with the first character becoming the last; a rotation to the right is similar but in the opposite direction. The canonical list so generated is what most of the checks are applied against; if any (possibly rotated) canonical form in the list fails a check, the password is considered inadvisable and is rejected.

Any subsequent lines read from the standard input are taken to be a ``stop list'' of disallowed passwords. Each line in the stop list is reduced to its canonical form and checked against the canonical list; if there is a match, the password is rejected.

When a password is rejected, the reason is written to the standard error output and goodpw exits with a non-zero status. If a password passes all checks and hence is not rejected, no message is issued and goodpw exits with a zero status.

The -s and -m options modify this behavior: If -s is specified, no reason is issued. If -m is specified, then:

  1. the stop list terminates with an empty line,

  2. one line is written to the standard output indicating the acceptance or rejection of the password, and

  3. the entire procedure is repeated using a new password and stop list read from the standard input.

This allows one goodpw process to check multiple passwords. The line written by goodpw to the standard output if -m is specified is one of:

The password passed all checks and seems to be acceptable.

The password was rejected for the indicated reason.

The indicated system error occurred and it cannot be determined whether or not the password is acceptable.
If -s was specified, then no reason or error is written after an r or e, respectively.

The other options are:

Use American spelling (default).

Use British spelling.

Specify the message to be issued in case the proposed password matches one of those in the stop-list. The default reason is ``same as previous password''.

Read the named file (which should be in the same format as /etc/default/goodpw) and apply the various checks specified.

The password must match expr, a boolean combination of regular expressions. If the first character of expr is a slash (/) and a regular file by that name exists, the contents of that file are used as the expression. (If the file cannot be read, an error results.)

The password must not match expr.
The boolean combination of regular expressions (expr) is built from the following operations:

expr1 & expr2
True if, and only if, both expressions expr1 and expr2 are true. If expr1 is not true, expr2 is not evaluated.

expr1 | expr2
True if either (or both) of expr1 or expr2 is true. If expr1 is true, expr2 is not evaluated.

expr1 ^ expr2
True if exactly one of expr1 and expr2 are true. Both expr1 and expr2 are always evaluated.

! expr
True if expr is not true; expr is always evaluated.

( expr )
True if, and only if, expr is true; expr is always evaluated.

True if, and only if, regular expression re matches the password. Any regular expression defined by regcmp(S) is understood; substrings defined by (...)$n are placed in ``accumulator'' n.

$n ~ /re/
True if, and only if, accumulator n (0-9, or *) matches regular expression re; accumulator star (*) is the entire password.

$n !~ /re/
True if, and only if, accumulator n is not matched by regular expression re.
The possible goodpw checks, their control settings in /etc/default/goodpw, and default values are:

Should the canonical list be checked against mail aliases obtained from /usr/lib/mail/aliases?

Should the canonical list be checked against group names and group member lists, obtained from /etc/group?

Should the canonical list be checked against machine names obtained from a number of files, including /etc/systemid and /usr/lib/mail/top?

Should the canonical list be checked against user login names and real names, obtained from /etc/passwd?

Should the canonical list be checked for properly spelled English words?

Should spell use American or British spelling? Which spelling to use may be specified by the -a and -b options.

How left rotations of the canonical form of the password should be treated: NO -- ignored; YES -- considered in other checks (that is, added to the canonical list) and may contain duplications; UNIQUE -- considered in other checks but must not contain any duplications.

Similarly for right rotations.

Similarly for rotations in both directions taken together.

An expression (expr), or the name of file containing an expression, that the password must match. This expression also may be specified by the -M option.

An expression, or the name of a file containing an expression, that the password must not match. This expression may also be specified by the -R option.

The name of a program to run to provide additional checking. The program is run with no arguments. Passed to the program on its standard input, on separate lines, is first the actual proposed password and then the canonical list. If the program exits with a non-zero status, the password is rejected.

SITEREASON=Rejected by site-specific check(s)
The reason to give when the SITECHECKS program rejects the password. The values for the default settings can be adjusted to reflect the local system's security concerns. If /etc/default/goodpw does not exist or cannot be read, the above default values are used (except for MATCH and REJECT).

The default MATCH expression, defined in /usr/lib/goodpw/match, matches any password that satisfies one of the following criteria:

The default REJECT expression, defined in /usr/lib/goodpw/reject, is:

   /[Ss][Cc][Oo]/ | /[Xx][Ee][Nn][Ii][Xx]/ | /[Uu][Nn][Ii][Xx]/
This matches any password that contains one of the strings: ``SCO'', ``XENIX'', or ``UNIX'', regardless of case.


Not all valid English words are known to spell, and hence some English words are considered acceptable as passwords.

The maximum length of a password is 100 characters, none of which may be an ASCII NUL or LF (newline).

Empty passwords are always rejected.


default MATCH expression that all passwords must match

default REJECT expression that no passwords should match

See also

default(F), group(F), passwd(C), passwd(F), regex(S), spell(C), systemid(F)

Standards conformance

goodpw is not part of any currently supported standard; it is an extension of AT&T System V provided by The Santa Cruz Operation, Inc.
© 2003 Caldera International, Inc. All rights reserved.
SCO OpenServer Release 5.0.7 -- 11 February 2003