=head1 NAME

kpwvalid - Checks quality of new password

=head1 DESCRIPTION

The C<kpwvalid> command checks the quality of a new password passed to it
from the C<kpasswd> or C<kas setpassword> command. It is optional. If it
exists, it must reside in the same AFS directory as the binaries for
the C<kpasswd> and C<kas> command suites (create a symbolic link from the
client machine's local disk to this directory). The directory's ACL
must extend the B<a> (B<administer>) and B<w> (B<write>) permissions to the
B<system:administrators> group only. These requirements prevent
unauthorized users from substituting a spurious C<kpwvalid> binary.

The AFS distribution includes an example C<kpwvalid> program that checks
that the password is at least eight characters long; the code for it
appears in the following L</"EXAMPLES"> section.

The script or program must accept a sequence of password strings, one
per line, on the standard input stream. The first is the current
password and is ignored. Each subsequent string is a candidate
password to be checked. The program must write the following to the
standard output stream for each one:

=over

=item *

0 (zero) and a newline character to indicate that the password is
acceptable

=item *

A non-zero decimal number and a newline character to indicate that
the password is not acceptable

=back

Further, it must write any error messages only to the standard error
stream, not to the standard output stream.

=head1 EXAMPLES

The following example program, included in the AFS distribution,
verifies that the requested password includes eight or more
characters.

   #include <stdio.h>
   /* prints 0 if the password is long enough, otherwise non-zero */
   main()
   {
   char oldpassword[512];
   char password[512];

   if (fgets(oldpassword, 512, stdin))
      while (fgets(password, 512, stdin)) {
         if (strlen(password) > 8) { /* password includes a newline */
            fputs("0\n",stdout);
            fflush(stdout);
         }
         else {
            fputs("Passwords must contain at least 8 characters.\n",
                  stderr);
            fputs("1\n",stdout);
            fflush(stdout);
         }
      }
   return 0;
   }

=head1 COPYRIGHT

IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.

Converted from html to pod by Alf Wachsmann <alfw@slac.stanford.edu>, 2003,
and Elizabeth Cassell <e_a_c@mailsnare.net>, 2004,
Stanford Linear Accelerator Center, a department of Stanford University.

=head1 SEE ALSO

L<kas_setpassword(1)>,
L<kpasswd(1)>

=cut
