9

Sadly, I have been doing Linux Administration for a short while and I still have NO idea where to find a comprehensive list of allowable characters for a linux password. My guess is that this may be because the configuration might be different on different systems depending on the configuration, for example: passwd file vs Open LDAP. Is there any comprehensive list of allowed Linux credentials when using authz/passwd/shadow files?

Improve this question
1

3 Answers 3

Reset to default
4

Anything you can type is fair game in a standard Unix password - I'm not aware of any Linux-specific restrictions. With the caveat that a newline (Return/Enter) usually ends password input, any character you see on your keyboard is fair game.

Special keys are also allowed (arrow keys, function keys, page up/page down), as are some things you CAN'T type (you can go ahead and put a vertical tab in your password if you want to - it's just going to be VERY inconvenient to use that to log in unless you can cut and paste the character).
Be aware that these keys/characters may not work the same over a network connection as they do on a console though -- typically they aren't used for that reason.

The one "special case" I'm aware of is that a NUL character (ASCII 0) would probably be interpreted as "END OF STRING" and anything after that in your password might be discarded.

Improve this answer
2
  • 2
    Some applications will add additional restrictions. Maybe a terminal emulator accepts [ as starting a control sequence, for example, or a poorly-written web application improperly reads \ . When I was generating initial passwords to be used by application accounts at a previous employer, I limited the set of non-alphanumerics to just a few characters known to work in all of our applications, because we had hired some spectacularly bad developers & bought truly junk software over the years.
    – dannysauer
    May 19, 2016 at 21:39
  • This is definitely not true. I just found one counter-example. On Ubuntu, the Unicode character u00a4 does not work. You can set such a password, but the login screen will not accept it. Whether this is by design, or simply an edge case that has not been tested, I don't know. So unfortunately, you might be stuck with just using ASCII characters.
    – Kevin Keane
    Sep 30, 2018 at 18:25
2

It will help if you can provide your Linux distribution. This can be defined per system and as you rightly point out if something like LDAP is in place it may be defined there.

If using pam_cracklib(8), this is defined in /etc/pam.d/system-auth on Red Hat/CentOS/Fedora systems. If defined you should see something like this:

password required pam_cracklib.so minlen=12 lcredit=1 ucredit=1 dcredit=2 ocredit=1

On Ubuntu systems this would be under /etc/pam.d/common-password. See https://askubuntu.com/questions/156850/setting-minimum-password-requirements

Improve this answer
2
  • I use mostly RHEL, specifically CentOS with some Ubuntu peppered in. I am surprised to hear that it is distro specific. If we are strictly talking about /etc/passwd and /etc/shadow with a default install, where are the allowed characters defined?
    – user160910
    Jun 4, 2013 at 20:49
  • 1
    This answers the question How do you set requirements for (stronger) passwords? (complexity, length, etc.). It does not appear to answer the question asked above (What characters may I use in a password?)
    – voretaq7
    Jun 5, 2013 at 16:05
1

Just stick to the 95 printable characters in ASCII for Linux passwords and you should be fine.

In a LDAP tree the Schema is responsible for information constraints. You should study your implementation specific schemas.

Improve this answer

You must log in to answer this question.