I'm working on implementing password quality requirements in Ubuntu Server 16.04LTS. I have configured 'pwquality.conf' with the requirements and '/etc/pam.d/common-password' to add pam_pwquality.so to the stack. When I attempt to change the password for a user using an obviously inadequate password, it returns an error saying that it doesn't meet the requirements, but then approves it anyway.

Here's my common-password config:

password    requisite                     pam_pwquality.so retry=2
password    [success=1 default=ignore]    pam_unix.so obscure sha512 rounds=5000 remember=5
password    requisite                     pam_deny.so
password    requisite                     pam_permit.so
password    optional                      pam_encrypt.so

The process of changing my password with a password that obviously does not meet requirements is as follows:

#sudo passwd test
New password: 
BAD PASSWORD:The password contains less than 1 digits
Retype new password: 
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully

Would appreciate any assistance. Thank you!

2 Answers 2


Did you try to change your password within the userspace of the user test? If you try to change it via sudo/root you bypass the rules unless you put an additional "enforce_for_root" behind your pam_pwquality.so call.

You should do the following:

#> su test -
#> passwd

If the quality is not enforced after that, then there must be some additional error in your config.


Add the following phrase of enforce_for_root: This ensures that the password policies are adhered to even if it’s the root user configuring the passwords.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .