I want to enforce password complexity on my RH system (local authentication) and have discovered that I need a pam module line something similar to this:

password  required pam_cracklib.so dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8

My question is should I be altering /etc/pam.d/login or /etc/pam.d/system-auth and what is the difference between the two files?

  • Can someone correct the subject to have the correct slashes? – David Pashley Jun 6 '09 at 5:23
  • What's wrong with the slashes? – oneodd1 Jun 8 '09 at 11:47

You want system-auth. It is a "generic" set of PAM parameters used by (typically) all services on the system. The login service is used by (unsurprisingly) the /bin/login program (which is invoked for logins to virtual consoles only). If you add that line to /etc/pam.d/login, then only password changes initiated by the login program would have the complexity requirements enforced (and, in case you're wondering, login doesn't do password changes).

| improve this answer | |

System-auth is for all types of login, including ssh

login is just for local console (NOT remote login)

| improve this answer | |
  • Thanks Mattymo for your answer but I had to go with womble for the more thorough explanation. – oneodd1 Jun 8 '09 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.