Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to enforce password complexity on my RH system (local authentication) and have discovered that I need a pam module line something similar to this:

password  required dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8

My question is should I be altering /etc/pam.d/login or /etc/pam.d/system-auth and what is the difference between the two files?

share|improve this question
Can someone correct the subject to have the correct slashes? – David Pashley Jun 6 '09 at 5:23
What's wrong with the slashes? – oneodd1 Jun 8 '09 at 11:47
up vote 5 down vote accepted

You want system-auth. It is a "generic" set of PAM parameters used by (typically) all services on the system. The login service is used by (unsurprisingly) the /bin/login program (which is invoked for logins to virtual consoles only). If you add that line to /etc/pam.d/login, then only password changes initiated by the login program would have the complexity requirements enforced (and, in case you're wondering, login doesn't do password changes).

share|improve this answer

System-auth is for all types of login, including ssh

login is just for local console (NOT remote login)

share|improve this answer
Thanks Mattymo for your answer but I had to go with womble for the more thorough explanation. – oneodd1 Jun 8 '09 at 11:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.