Is there any way to set up minimum passcode requirements, such as a minimum length, requirement of mixed case alphanumerics and at least 1 symbol in the passcode, and enforce that at passcode changes?

up vote 21 down vote accepted

Password complexity in Ubuntu is controlled by PAM. Unfortunately, PAM is "typically Unix" like in its approach. Meaning that it spreads its configuration through a large number of very confusing files.

The file that controls password complexity is:

/etc/pam.d/common-password

There is a line:

password [success=1 default=ignore] pam_unix.so obscure sha512

Which defines the basic rules for password complexity. You can add a minimum length override by changing it to:

password [success=1 default=ignore] pam_unix.so obscure sha512 minlen=12

or whatever minimum you want. As you can see, the default already defines some basic obscurity rules. These basic rules can be seen in:

man pam_unix

Search for "obscure".

There are a large number of pam modules that can be installed.

apt-cache search libpam-

Should show you them.

You will need to hunt down the documenation for them I'm afraid. But the "cracklib" is a common addition.

UPDATE: I should have pointed out that the default "obscure" parameter includes tests for complexity based on previous passwords and simplicity (length, number of different types of character). The example in the manpage shows cracklib in action. Install libpam_cracklib to get that working.

Also, once you have worked out what to change, the changes are the same in other files so that you can enforce the same (or different) password checks for SSH and other applications.

  • Wonderful, thanks. – Thomas Ward Jun 28 '12 at 15:13
  • According to man pam_unix, the default password minlength is 6 chars if you search minlen. – Timo Feb 10 at 9:19
  • this doesnt work for ubuntu 18.04 - even with this setting I can put any password I want (short, palindrome,.. ) - I just need to repeat such password 4x :( – xhudik Sep 27 at 12:15
  • When you say "doesn't work", it isn't clear what you mean. Do you mean that it does work but that repeating the short password 4 times is some kind of "bypass" - if so, respectfully, you are wrong, that is still a strong passcode. Otherwise, could you please clarify? – Julian Knight Sep 30 at 20:56

Password values are controlled in the file

/etc/pam.d/common-password

For more information on how to modify the file see pam_unix manpage

  • 1
    You've listed pam_unix(5), the correct page is pam_unix(8) linux.die.net/man/8/pam_unix. In fact, the online versions of the manpage, for some reason don't seem to list the important section on the "obscure" parameter - the one that I've included in my answer. If you do a man pam_unix, you will be able to see it though. – Julian Knight Jun 27 '12 at 20:57
  • 1
    @JulianKnight Thanks for the comment. I fixed the link :) – Mitch Jun 28 '12 at 5:16

Pre-installed PAM modules allow you to set up basic requirements within the light of complexity. There is a nice module which is a successor of pam_cracklib module - pam_pwquality. In order to install it type the following

apt-get install libpam-pwquality

then get familiar with this one

man pam_pwquality

especially with the "Options" section.

Now you can edit the common-password in /etc/pam.d/

vi /etc/pam.d/common-password

find the line which contains the following "password requisite pam_pwquality.so" statement and after pam_pwquality.so attach your options like this

password        requisite         pam_pwquality.so minlen=16 ucredit=-4 retry=3

which stands for "the minimum size of password is 16 characters, where minimum 4 of them a uppercase. Prompt user for password 3 times.

pam_pwquality allows you make much more complex password requirements in combination with other modules like pam_pwhistory. Good luck

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.