I am checking the password complexity of ocredit in /etc/pam.d/password-auth which is this line :

password   requisite pam_pwquality.so try_first_pass retry=3 minlen=8 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=1 gecoscheck=1

I would like to grep the ocredit value "1" and make it as variable, let say check_ocredit.

My script would be checking, if the ocredit value is not 0, then it will return "true", otherwise, it will show what is the current value set in /etc/pam.d/password-auth.

Here's my logic that I'm going to implement :

if [[ $check_ocredit -ne "0" ]]
   echo "Current ocredit value is : $check_ocredit"

The output will looks like this :

Current ocredit value is : 1

I try with :

grep ocredit /etc/pam.d/password-auth | awk '{print $10}' | awk -F "=" '{print $2}'

But I was thinking, what if ocredit is missing, or it is not at 10th position.. so my result would be wrong. Can anyone advice me on this?

  • I just figure a way to get the ocredit value is by running this : grep ocredit /etc/pam.d/password-auth | sed -n 's/^.*ocredit/ocredit/p' | awk -F " " '{print $1}' | awk -F "=" '{print $2}' but, I am open if anyone have other simpler method to share. Thank you.
    – msmystic
    Aug 15 at 9:10
  • See if this helps: askubuntu.com/a/922615/158442
    – muru
    Aug 15 at 9:34

3 Answers 3


You can do it in a single grep command with -o for "print only the matching portion of the line" and -P which gives us \K: "ignore anything matched up to here":

$ grep -oP 'ocredit=\K\d+' /etc/pam.d/password-auth

So, in your script, you could do:

check_ocredit=$(grep -oP 'ocredit=\K\d+' /etc/pam.d/password-auth)
if [[ "$check_ocredit" -ne "0" ]]
     echo "Current ocredit value is : $check_ocredit"

Your version of the if would have printed the value only when it was 0.


You can try with this

awk -F'(ocredit=)' '{print $2}' /etc/pam.d/password-auth | awk '{print $1}'

To get the value in variable possible solution can be:

check_ocredit=$(awk -F'(ocredit=)' '{print $2}' /etc/pam.d/password-auth | awk '{print $1}')

The first awk will get the substring after ocredit= which will be something like 1 gecoscheck=1 in your case, and the second awk will get you only the number.

  • It probably can be done in a single awk call like awk -F'ocredit=' '{print substr($2,1,1)}'
    – Raffa
    Aug 15 at 14:04

If sed is an option, then:

sed -n 's/.*ocredit=\([0-1]\).*/\1/p' /etc/pam.d/password-auth

Will look only(to match any single number, use [0-9] instead of [0-1]) for either a 0 or a 1 after ocredit= and print it if found ... The output of that sed command can be stored in a variable e.g. check_ocredit using command substitution syntax like so:

check_ocredit=$(sed -n 's/.*ocredit=\([0-1]\).*/\1/p' /etc/pam.d/password-auth)

It can be evaluated in your script in a more compact way(yielding similar result as you intend in your example) like so:

check_ocredit=$(sed -n 's/.*ocredit=\([0-1]\).*/\1/p' /etc/pam.d/password-auth)
[ "$check_ocredit" -eq "0" ] && echo "It's a zero" || echo "It's a $check_ocredit"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.