pam_pwcheck(8) Reference Manual pam_pwcheck(8)NAMEpam_pwcheck - PAM module for password strength checking
DESCRIPTION
The pam_pwcheck is a PAM module for password strength checking. It
makes additional checks upon password changes, but does not perform the
change itself. It only provides functionality for one PAM management
group: password changing.
This module works in the following manner: if enabled, it first calls
the Cracklib routine to check the strength of the password; if crack
likes the password, the module does an additional set of strength
checks. These checks are:
Palindrome
Is the new password a palindrome of the old one?
Case Change Only
Is the new password the old one with only a change of case?
Similar
Is the new password too similar to old one?
Simple Is the new password too short?
Rotated
Is the new password a rotated version of the old password?
Already used
Was the password used in the past? Previously used passwords
are to be found in /etc/security/opasswd.
OPTIONS
The following options may be passed to the module:
cracklib=<path to dictionaries>
Use cracklib library for password checks. This parameter also
contains the path to the cracklib dictionaries. The default is
/usr/lib/cracklib_dict.
debug A lot of debug information is printed with syslog(3).
maxlen=number
Number of significant characters in the password for crypt(3).
A value of zero suppresses this check. The default is 0.
minlen=number
The minimum number of characters in an acceptable password. A
new password with fewer characters will be rejected. A value of
zero suppresses this check. The default is 5.
no_obscure_checks
No additional checks will be performed before a new password is
accepted. Since the checks performed are fairly simple, their
usage is recommended.
not_set_pass
If this option is given, pam_pwcheck will not make the new pass‐
word available for other modules.
nullok Normally the account is disabled if no password is set or if the
length of the password is zero. With this option you can allow
the user to change his password for such accounts. This option
does not overwrite a hardcoded default by the calling process.
tries=number
Maximum number of attempts to change a password if the new ones
are rejected because they are too easy.
use_authtok
Set the new password to the one provided by the previously
stacked password module. If this option is not set, pam_pwcheck
will ask the user for the new password.
use_first_pass
By default pam_pwcheck tries to get the authentication token
from a previous module. If no token is available, the user is
asked for the old password. With this option, pam_pwcheck
aborts with an error if no authentication token from a previous
module is available.
remember=XX
Remember the last XX passwords and do not allow the user to re‐
use any of these for the next XX password changes. XX is a num‐
ber between 1 and 400.
enforce_for_root
If this option is set, most of the password check rules are
enforced for root, too. Never use this option if you don't know
what you are doing, since it could be as result that root is no
longer allowed to login at all.
FILES
/etc/security/opasswd
SEE ALSOpasswd(1), pam.conf(8), pam.d(8), pam(8), rpasswd(1), rpasswdd(8),
rpc.yppasswdd(8), yppasswd(1)pam_pwcheck September 2008 pam_pwcheck(8)
