I want to reject our standard password in pam for the services until the user change it. It is a fixed password, well known by our users, but I don't know how I can configure pam to refuse it. I check cracklib, but it works only on password change, not on auth. I can't use pam_succeed_if as it doesn't check the password.

Any idea how reject this password ?


chage -d 0 username should do it. You might have to set a null initial password which probably isn't very secure but some trial and error testing should reveal if that's the case.


In that case can you spawn a login script upon login using /etc/profile, /etc/bash.bashrc or similar to set that password first and then let them ageing policy force it to be changed ?

  • I can't define a null password. I see that I can reject all the connections by pam for null passwords, but I would like to do this with a defined (specific) password. – Dom Apr 4 '11 at 10:46
  • I can't start the login script (it is mail servers without interactive shell), pam is just use to test the password and allow the connection. – Dom Apr 4 '11 at 14:49
  • Tricky. Hopefully someone else can help. – Jonathan Ross Apr 4 '11 at 15:15

Consider pam_exec

  • In last option, I will. But I would like to have quick login checks and no process cretaion if it is possible – Dom Apr 4 '11 at 14:49
  • Well, if you'd had thousands of log-ins every second this could really matter. In that interesting case I'd write my own PAM-module targeted for this task only. ;-) – poige Apr 4 '11 at 14:58
  • You are right, I can do that. If there is no easy way to do that – Dom Apr 4 '11 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.