Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm trying to set my password policy to remember the last two passwords a user chose, and to prevent him or her from re-using those particular passwords.

I'm currently running Ubuntu 12.10 through VirtualBox and using Putty to SSH to it.

Following the instructions on this site (The Password "History" section in particular), I have confirmed that my installation came with the file /etc/security/opasswd already present.

thomas@thomas-VirtualBox:~$ ll /etc/security/opasswd
-rw------- 1 root root 0 Oct 17  2012 /etc/security/opasswd

I have also added:

password required pam_unix.so md5 remember=2 use_authtok

to my /etc/pam.d/common-password file as instructed so that my /etc/pam.d/common-password file now looks like:

# ... other beginning comments above ^
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

#the next line was added by me
password  required pam_unix.so md5 remember=2 use_authtok

# here are the per-package modules (the "Primary" block)
password        [success=1 default=ignore]      pam_unix.so obscure sha512
# here's the fallback if no module succeeds
password        requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password        required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
password        optional        pam_gnome_keyring.so
# end of pam-auth-update config

Now, when I try to change a test user's password, I get all manner of strangeness. Note, in the following block, words surrounded in <> are the words I type for the password, even though they don't show up on the screen.

thomas@thomas-VirtualBox:~$ su test
Password:<asdfasdf>
test@thomas-VirtualBox:/home/thomas$ passwd
Changing password for test.
(current) UNIX password:<asdfasdf>
Changing password for test.
(current) UNIX password:<asdfasdf>
Enter new UNIX password:<testuser>
Retype new UNIX password:<testuser>
passwd: Authentication token manipulation error
passwd: password unchanged
test@thomas-VirtualBox:/home/thomas$ exit
exit
thomas@thomas-VirtualBox:~$ su test
Password:<asdfasdf>
su: Authentication failure
thomas@thomas-VirtualBox:~$ su test
Password:<testuser>
test@thomas-VirtualBox:/home/thomas$

So, for one, even though it tells me there's an Authentication token manipulation error and that the password is unchanged, it still changes the password to the new value (testuser) anyway.

On top of that, when I try to change the password again to the old value (which shouldn't be allowed) it allows it anyway.

thomas@thomas-VirtualBox:~$ su test
Password:<testuser>
test@thomas-VirtualBox:/home/thomas$ passwd
Changing password for test.
(current) UNIX password:<testuser>
Changing password for test.
(current) UNIX password:<testuser>
Enter new UNIX password:<asdfasdf>
Retype new UNIX password:<asdfasdf>
passwd: Authentication token manipulation error
passwd: password unchanged
test@thomas-VirtualBox:/home/thomas$ exit
exit
thomas@thomas-VirtualBox:~$ su test
Password:<testuser>
su: Authentication failure
thomas@thomas-VirtualBox:~$ su test
Password:<asdfasdf>
test@thomas-VirtualBox:/home/thomas$

Furthermore, when I go back to check the /etc/security/opasswd file, which should have the hashes of the former passwords used (at least I think it should), it turns out to be blank.

thomas@thomas-VirtualBox:~$ sudo cat /etc/security/opasswd
[sudo] password for thomas:
thomas@thomas-VirtualBox:~$

TL;DR - Trying to prevent users from re-using up to the last 2 passwords. Getting error when I try to change a password, but the password changes anyway. Password history is not getting remembered as well.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.