Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to configure an Ubuntu server to follow a strict company password policy that specifies the following:

  • at least one upper case
  • at least one lower case
  • at least one digit
  • at least one special character

I've had a look around and all I have found is the instructions for specifying the password length; but, I have yet to find something that relates to specifying the content of the password regarding the above points.

Any help would be appreciated.

share|improve this question
up vote 8 down vote accepted

Briefly, on Ubuntu, password complexity is enforced by the pam_cracklib module.

In order to modify the password policy for your local machine, you will need to modify your /etc/pam.d/common-password file.

From a terminal window Ctrl+Alt+T enter the following:

gksu gedit /etc/pam.d/common-password

Add the following line to the file and save the file:

password requisite ucredit=-1 lcredit=-1 dcredit=-1  ocredit=-1

This uses the following options:

  • dcredit == digit
  • ucredit == upper-case character
  • lcredit ==lower-case character
  • ocredit == other character (special characters, including ! , @ # $ %)

This should satisfy your requirements. You could also use the variables minlength and retries to further restrict the password requirements.

Another good example of modifying a password policy in this manner would be the following line:

password requisite retry=3 minlen=10 difok=3 ucredit=-1 lcredit=-1 dcredit=-1  ocredit=-1

This entry will set a maximum of three attempts at getting an acceptable password with a 10-character minimum length. This sets the requirement for users to have a minimum of three characters different from the last password. This also fulfills the requirement of having the password contain at least one each of digit, lower-case character, and upper-case character.

See also this simple explanation of available options for password requirements.

share|improve this answer
Excellent answer! I'd add, regarding retries, that it's important to be careful when considering a policy to prevent users from logging on who have too many recent failed login attempts. This can lead to the viability of one of the simplest and most easily executed denial of service attacks on an account (try and fail to log in X number of times until the account is "locked out" and then the legitimate user cannot get in). – Eliah Kagan Jan 17 '13 at 4:27
Fantastic answer, thanks :) One question though, it seems that the root user is able to ignore the password requirements... Is it possible to enforce this for the root user too? – Valorin Jan 17 '13 at 22:33
@Valorin What part of the password requirements is the root user not respecting? – Kevin Bowen Jan 18 '13 at 0:29
@maggotbrain Any of it, it throws a warning but still saves it, this was the password 'snare': – Valorin Jan 18 '13 at 0:45
@Valorin So, you've enabled the account called 'root' and can use this account with this password, correct? What warnings are you getting? Unfortunately, I don' t have a machine with an enabled root account to test this myself. It sounds like a bug, but need more info. – Kevin Bowen Jan 18 '13 at 1:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.