Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am configuring password rules in linux system(RedHat Enterprise linux 5). By google, I found that using pam_cracklib will make simple check automatically. That is, pam_cracklib will automatically check if the new password is the reverse one of the previous password. If yes, it will reject the new password.

However, I tried a new password just the reverse of the previous one, the new password can take effective! That is, pam_cracklib will allow the new password(reverse of the previous one). Here is my configuration:

password    required try_first_pass retry=3  minlen=6 

Could anyone tell me if there is something wrong with my configuration? Or there are some bugs with pam_cracklib?

Thanks a lot!

share|improve this question
Did you try to change the password as root or as a regular user? root can override all kinds of restrictions in many situations. – Janne Pikkarainen Sep 28 '10 at 7:20
Janne, I change password as a regular user, not root.So I am surprised why pam_cracklib doesn't take effective. – zhaojing Sep 28 '10 at 7:40
adding "obscure" to pam_cracklib will have similar effect – Hubert Kario Aug 16 '11 at 21:12

1 Answer 1

up vote 0 down vote accepted

You can't use try_first_pass with cracklib. It should check whatever the password is a palindrome or rotation of old password by default.

What's more, other modules (probably or in the stack must use the use_authok flag or they will be allowed to ask the user for password if previous module didn't accept the provided password.

In short, try:

password    required retry=3  minlen=6
password    required use_authok nullok md5

The nullok flag tells the module it's OK to change password from an empty one (the usual method of forcing a password change in UNIX systems), you can remove it if you don't use this functionality.

share|improve this answer
Hubert, thanks a lot for your detailed infos. – zhaojing Sep 30 '10 at 2:45
But It seems the method you proposed still can't solve the problem. – zhaojing Sep 30 '10 at 2:45
For example, if I first set passwd:1qaz2wsx, the second I set passwd:xsw2zaq1. It works. So the rotation checking seems doesn't take effective. – zhaojing Sep 30 '10 at 2:46
The palindrome is just for a new password (you can't have a "qwertrewq" password). Rotation checks only for simple word rotation, as when you start a word in the middle and add the start to the end: so with old password "password", the new password can't be "sswordpa" or "wordpass". As such, I don't think you should worry about this combination, it's rather obscure. Anyway, you may be interested in discussion in…. – Hubert Kario Sep 30 '10 at 8:02
Hobert, thanks a lot for your help and your suggested webpage. – zhaojing Sep 30 '10 at 8:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.