Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two questions about the system-auth file

1) If the /etc/pam.d/system-auth password complexity settings are changed on an existing system, does it invalidate any existing passwords?

2) Is it possible to say that lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 <-- at least three out of the four character groups should be enforced?



2) is answered here: and

share|improve this question
as you answered yourself, pam_passwdqc is better than pam_cracklib, easier to configure and easier to understand – Hubert Kario Aug 16 '11 at 21:09
up vote 2 down vote accepted

Ad 1) To the best of my knowledge it does not. You will have changed rules for creating new passwords, not requirements for accepting already set passwords. If you want to force users to change their passwords to one complying with the new rule set age their passwords.

Ad 2) pam_cracklib doesn't give you that kind of flexibility. You either enforce minimum number of characters of given type (Xcredit<0) or you give extra credit (+1 "length") for up to N characters of given type (Xcredit=N>0) and set minlen high enough to be satisfactory even if user choses characters of one type only.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.