I am configuring password rules in linux system(RedHat Enterprise linux 5). By google, I found that using pam_cracklib will make simple check automatically. That is, pam_cracklib will automatically check if the new password is the reverse one of the previous password. If yes, it will reject the new password.

However, I tried a new password just the reverse of the previous one, the new password can take effective! That is, pam_cracklib will allow the new password(reverse of the previous one). Here is my configuration:

password    required    pam_cracklib.so try_first_pass retry=3  minlen=6 

Could anyone tell me if there is something wrong with my configuration? Or there are some bugs with pam_cracklib?

Thanks a lot!

  • Did you try to change the password as root or as a regular user? root can override all kinds of restrictions in many situations. – Janne Pikkarainen Sep 28 '10 at 7:20
  • Janne, I change password as a regular user, not root.So I am surprised why pam_cracklib doesn't take effective. – zhaojing Sep 28 '10 at 7:40
  • adding "obscure" to pam_cracklib will have similar effect – Hubert Kario Aug 16 '11 at 21:12

You can't use try_first_pass with cracklib. It should check whatever the password is a palindrome or rotation of old password by default.

What's more, other modules (probably pam_unix.so or pam_ldap.so) in the stack must use the use_authok flag or they will be allowed to ask the user for password if previous module didn't accept the provided password.

In short, try:

password    required    pam_cracklib.so retry=3  minlen=6
password    required    pam_unix.so use_authok nullok md5

The nullok flag tells the module it's OK to change password from an empty one (the usual method of forcing a password change in UNIX systems), you can remove it if you don't use this functionality.

  • But It seems the method you proposed still can't solve the problem. – zhaojing Sep 30 '10 at 2:45
  • For example, if I first set passwd:1qaz2wsx, the second I set passwd:xsw2zaq1. It works. So the rotation checking seems doesn't take effective. – zhaojing Sep 30 '10 at 2:46
  • The palindrome is just for a new password (you can't have a "qwertrewq" password). Rotation checks only for simple word rotation, as when you start a word in the middle and add the start to the end: so with old password "password", the new password can't be "sswordpa" or "wordpass". As such, I don't think you should worry about this combination, it's rather obscure. Anyway, you may be interested in discussion in serverfault.com/questions/4221/…. – Hubert Kario Sep 30 '10 at 8:02
  • Hobert, thanks a lot for your help and your suggested webpage. – zhaojing Sep 30 '10 at 8:40
  • In fact, the information by google makes me confused. – zhaojing Sep 30 '10 at 8:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.