Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to enforce password complexity on my RH system (local authentication) and have discovered that I need a pam module line something similar to this:

password  required pam_cracklib.so dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8

My question is should I be altering /etc/pam.d/login or /etc/pam.d/system-auth and what is the difference between the two files?

share|improve this question
    
Can someone correct the subject to have the correct slashes? –  David Pashley Jun 6 '09 at 5:23
    
What's wrong with the slashes? –  oneodd1 Jun 8 '09 at 11:47

2 Answers 2

up vote 5 down vote accepted

You want system-auth. It is a "generic" set of PAM parameters used by (typically) all services on the system. The login service is used by (unsurprisingly) the /bin/login program (which is invoked for logins to virtual consoles only). If you add that line to /etc/pam.d/login, then only password changes initiated by the login program would have the complexity requirements enforced (and, in case you're wondering, login doesn't do password changes).

share|improve this answer

System-auth is for all types of login, including ssh

login is just for local console (NOT remote login)

share|improve this answer
    
Thanks Mattymo for your answer but I had to go with womble for the more thorough explanation. –  oneodd1 Jun 8 '09 at 11:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.