1

I was today trying to change my password on our lab servers (SUSE) with passwd and got the error message that my password was "based on a dictionary word", which it really wasn't. I'd like to change and adapt these constraints and limits on setting a password (I'm the admin) and am wondering how to do that?

Update: Found this row in my /etc/security/pam_pwcheck.conf:

password:       nullok use_cracklib

Is there any way I can make it just warn about this rather than preventing me from setting the password?

Update 2: Also found this in /etc/pam.d/common-password:

password required       pam_pwcheck.so  nullok
password required       pam_unix2.so    nullok use_authtok

If I remove the use_cracklib parameter, I remove the check. I tried adding:

password optional       pam_cracklib.so

but it did not help. I have disabled the cracklib functionality, but now I don't even get a warning.

Update 3:

Tried this (/etc/pam.d/common-password):

password optional pam_pwcheck.so nullok 
password required pam_unix2.so nullok use_authtok 

and (/etc/security/pam_pwcheck.conf):

password: use_cracklib nullok 

This, however, does not give the desired effect, I still can't ignore the warning.

4 Answers 4

2

Using password optional pam_cracklib.so won't help you along. You need to put an password optional pam_pwcheck.so in there so it actually has some effect. If it is followed by the line with pam_unix.so, it should work out just as you wanted.

1
  • Updated my question after trying this. Jul 14, 2009 at 12:58
1

Well, that depends on the systems authentication configuration. What version of SuSE are you running?

On my SuSE (10.1), authentication is handled via PAM, like practically all modern linux distros. There, authentication is configured via files in /etc/pam.d/.

There is one file per "service". You are interested in /etc/pam.d/passwd, which on my system references (via including common-password) the PAM module pam_pwcheck. This is the module that enforces pw regulations. See man pam_pwcheck for how to configure it.

If you have a different PAM config, you might use a different mechanism, but the basic idea is the same.

1
  • That is indeed the file referenced and the option use_cracklib in the /etc/security/pam_pwcheck seems to be the offender here. I would just like it to warn me about this rather than stop the password from being set, any ideas? Jul 14, 2009 at 8:47
0

From passwd man page:

Then, the password is tested for complexity. As a general guideline, passwords should consist of 6 to 8 characters including one or more characters from each of the following sets:
 ·   lower case alphabetics
 ·   digits 0 thru 9
 ·   punctuation marks

On Sun Solaris, the behavior can be controller via /etc/defaults/passwd [1].

Also, on my Debian system there's a /etc/login.defs file which can have PASS_MIN_LEN option, though manual for login.defs file says it's no longer used by passwd and points to /etc/pam.d/passwd.

I do not know of a way to configure this behavior via /etc/pam.d/passwd.

  1. http://www.unix.com/sun-solaris/30617-password-complexity-check.html
0

Another option is to use cracklib. This article should give you some pointers.

2
  • OpenSuse already uses cracklib by default, set in /etc/pam.d/common-password-pc, and the cracklib dictionaries are set up in the apparmor profile for passwd (i.e. usr.bin.passwd)
    – mas
    Jul 14, 2009 at 8:41
  • Cracklib indeed seems to be the cause of this message. Now, it's a nice message and all but it would be better if it just warned me rather than preventing the password being set altogether. Jul 14, 2009 at 8:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .