Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was today trying to change my password on our lab servers (SUSE) with passwd and got the error message that my password was "based on a dictionary word", which it really wasn't. I'd like to change and adapt these constraints and limits on setting a password (I'm the admin) and am wondering how to do that?

Update: Found this row in my /etc/security/pam_pwcheck.conf:

password:       nullok use_cracklib

Is there any way I can make it just warn about this rather than preventing me from setting the password?

Update 2: Also found this in /etc/pam.d/common-password:

password required  nullok
password required    nullok use_authtok

If I remove the use_cracklib parameter, I remove the check. I tried adding:

password optional

but it did not help. I have disabled the cracklib functionality, but now I don't even get a warning.

Update 3:

Tried this (/etc/pam.d/common-password):

password optional nullok 
password required nullok use_authtok

and (/etc/security/pam_pwcheck.conf):

password: use_cracklib nullok

This, however, does not give the desired effect, I still can't ignore the warning.

share|improve this question

Using password optional won't help you along. You need to put an password optional in there so it actually has some effect. If it is followed by the line with, it should work out just as you wanted.

share|improve this answer
Updated my question after trying this. – Stefan Thyberg Jul 14 '09 at 12:58

Well, that depends on the systems authentication configuration. What version of SuSE are you running?

On my SuSE (10.1), authentication is handled via PAM, like practically all modern linux distros. There, authentication is configured via files in /etc/pam.d/.

There is one file per "service". You are interested in /etc/pam.d/passwd, which on my system references (via including common-password) the PAM module pam_pwcheck. This is the module that enforces pw regulations. See man pam_pwcheck for how to configure it.

If you have a different PAM config, you might use a different mechanism, but the basic idea is the same.

share|improve this answer
That is indeed the file referenced and the option use_cracklib in the /etc/security/pam_pwcheck seems to be the offender here. I would just like it to warn me about this rather than stop the password from being set, any ideas? – Stefan Thyberg Jul 14 '09 at 8:47

From passwd man page:

Then, the password is tested for complexity. As a general guideline, passwords should consist of 6 to 8 characters including one or more characters from each of the following sets:
 ·   lower case alphabetics
 ·   digits 0 thru 9
 ·   punctuation marks

On Sun Solaris, the behavior can be controller via /etc/defaults/passwd [1].

Also, on my Debian system there's a /etc/login.defs file which can have PASS_MIN_LEN option, though manual for login.defs file says it's no longer used by passwd and points to /etc/pam.d/passwd.

I do not know of a way to configure this behavior via /etc/pam.d/passwd.

share|improve this answer

Another option is to use cracklib. This article should give you some pointers.

share|improve this answer
OpenSuse already uses cracklib by default, set in /etc/pam.d/common-password-pc, and the cracklib dictionaries are set up in the apparmor profile for passwd (i.e. usr.bin.passwd) – mas Jul 14 '09 at 8:41
Cracklib indeed seems to be the cause of this message. Now, it's a nice message and all but it would be better if it just warned me rather than preventing the password being set altogether. – Stefan Thyberg Jul 14 '09 at 8:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.