Linux – Disable password complexity check (PAM)

linuxpampasswdpassword

I installed a Linux based system with a blank password. I wanted to change password to something simple, but using passwd and setting the password to something like a single symbol gave an error of “password being a palindrome”.

How to disable password complexity checks?

Best Answer

I found out my system (as most modern Linux) use PAM (Pluggable Authentication Modules) and pam_cracklib module within it. pam_cracklib enforces minimum length of 6 symbols regardless of parameters, so solution is to turn it off.

One link I've read discussed editing password-ac and system-ac files in /etc/pam.d, the contents of both files were same and no explanation was given of their respective roles.

Upon study of PAM docs (The Linux-PAM System Administrators' Guide | linux-pam.org), I learned PAM configs for LINUX services are in that /etc/pam.d directory in separate files. I saw passwd file and it in found only system-ac file mentioned (added by substack keyword), so on my system I needed to edit only system-ac.

Making pam_cracklib optional made no difference (I guess that's because pam_cracklib did not pass entered and rejected pasword to next module in stack - pam_unix) and commenting line with pam_cracklib lead to errors during passwd run. I noted that next line with ordinary pam_unix had option use_authtok (docs: enforce the module to set the new password to the one provided by a previously stacked module). After I deleted that option and commented line with pam_cracklib I now able to set short passwords with passwd.

Related Solutions

How to check for empty passwords

An easy way to find encrypted empty or weak passwords is to use a password cracker like John the Ripper.

If you are using NIS or LDAP you need first to extract the password hashes from the database - one way is via getent, see the answer from maxschlepzig

Fedora – How to bypass Fedora’s password complexity requirments

As root you can bypass the requirements. Your example shows this happening:

# passwd justincase
Changing password for user justincase.
New password:
BAD PASSWORD: The password fails the dictionary check - it is based on a dictionary word
Retype new password:
#

Notice it does not repeat the New password prompt but instead it asks you to retype the (bad) new password you are entering. If you had continued with the alleged bad password you would have been able to set it as the password for justincase.

Best Answer

Related Solutions

How to check for empty passwords

Fedora – How to bypass Fedora’s password complexity requirments

Related Question