I know that it is a "bad" idea, I know that it is not secure, I know. I searched the net for an answer and all I saw was whining that it's not good. But I like using Linux because it lets me make the system I want and like to use. The end of intro.

I try to change password:

ruslan:~% passwd
Changing password for ruslan.
(current) UNIX password:
Enter new UNIX password:
Retype new UNIX password:
You must choose a longer password

If I try sudo passwd ruslan then I can set any password I want so I don't need password complexity checks for passwd on my system.

After googling I've found that there should be PAM module pam_cracklib that tests password for complexity and it can be configured. But my PAM password settings doesn't include pam_cracklib:

% cat /etc/pam.d/passwd | grep '^[^#]'
@include common-password
% cat /etc/pam.d/common-password | grep '^[^#]'
password    [success=1 default=ignore]  pam_unix.so obscure sha512
password    requisite           pam_deny.so
password    required            pam_permit.so
password    optional    pam_gnome_keyring.so 

I guess that pam_unix makes this test... Oops... Guys, the moment I finished to write this sentence I've got an enlightenment and typed man pam_unix in terminal where I've found needed options for pam_unix module.

I just removed option obscure and added minlen=1 and now I'm happy. So now I have this line in /etc/pam.d/common-password:

password    [success=1 default=ignore]  pam_unix.so minlen=1 sha512

and I can set any password I want.

I decided to keep this post for people who might need this solution also. Sorry and thanks.

  • I can't answer my own question for 8 hours after asking, will wait :) – rslnx Mar 17 '12 at 11:47
  • I simply wanted to change my pwd to 123. Couldn't do that with passwd. Tried "sudo passwd <user_name>" and it worked like charm. Didn't need rest of the mumbo-jumbo. Thanks for that part! : ) – zeFree Oct 2 '13 at 13:22
  • @zeFree, the key point of my solution is allowing any user (not having sudo permissions) to use simple passwords – rslnx Oct 4 '13 at 20:29
  • Great Intro. I have a windows laptop that spends 50% cpu cycles protecting me from viruses. Guess what? Do not need any viruses. The computer is already worthless. So .. linux lets us do what we want. I'm behind a firewall and the computer does not leave my home. Short password? Yes please. – javadba Dec 3 '16 at 6:28
up vote 44 down vote accepted

Ok, I will answer my question :)

I've found that pam_unix module performs password complexity check and it can be configured.

man pam_unix:

   minlen=n
       Set a minimum password length of n characters. The default value is
       6. The maximum for DES crypt-based passwords is 8 characters.

   obscure
       Enable some extra checks on password strength. These checks are
       based on the "obscure" checks in the original shadow package. The
       behavior is similar to the pam_cracklib module, but for
       non-dictionary-based checks.

Solution:
Alter the line in the pam_unix module in the /etc/pam.d/common-password file to:

password    [success=1 default=ignore]  pam_unix.so minlen=1 sha512

It allows you to set any password with minimal length of 1.

If it is a once off, using the passwd command as root you can set a simple password for a user by simply entering the desired value.

  • If you reread my question, you will find this sentence: "If I try sudo passwd ruslan then I can set any password I want so I don't need password complexity checks for passwd on my system." So thank you, I know. – rslnx Mar 19 '15 at 13:19

Open common-password config file for editing

sudo gedit /etc/pam.d/common-password

Comment this line :

#password   [success=2 default=ignore]  pam_unix.so obscure use_authtok try_first_pass sha512

Also comment this line, otherwise password setting will ask you to pass a mix of upper/lower case letters :

#password   requisite           pam_passwdqc.so enforce=everyone max=18 min=disabled,8,8,1,1 retry=2 similar=deny

now just add this line into the same file:

password    [success=1 default=ignore]  pam_unix.so **minlen=1** sha512

this should do it...

  • FYI, there is no pam_passwdqc.so line in my default install of 14.04 server. Maybe someone (admin?) added it on purpose? ;) – Tomofumi Aug 29 '14 at 8:40

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.