Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am trying to use PAM to stop password reuse. Adding 'remember=24' to pam_unix stores the old passwords hashed with MD5 which I find unnerving. I was recommended 'pam_pwhistory' instead. Here is the password section of my /etc/pam.d/system-auth file that /etc/pam.d/passwd includes

password    requisite     pam_cracklib.so retry=3 try_first_pass
password    requisite     pam_pwhistory.so remember=24 retry=3 use_authtok
password    sufficient    pam_unix.so sha512 rounds=5000 shadow use_authtok
password    required      pam_deny.so

When I try to change my password, if I fail the password reuse test, I don't get to retry. Instead a "Password:" prompt appears

$ passwd
(current) Unix password: <current password>
New password: <old password>
Retype new password: <old_password>
Password has already been used. Choose another.
Password: <current password>
passwd: Authentication token manipulation error

I have a similar same issue if I fail the pam_cracklib test more than the retry #. Except that my current password works with the prompt

$ passwd
(current) Unix password: <correct password>
New password: <too simple password>
BAD PASSWORD: it too simple
New password: <too simple password>
BAD PASSWORD: it too simple
New password: <too simple password>
BAD PASSWORD: it too simple
Password: <current password>
passwd: Have exhausted maximum number of retries for service

If I set retry=1 for pam_pwhistory, then the current password works for the prompt.

$ passwd
(current) Unix password: <current password>
New password: <old password>
Retype new password: <old_password>
Password has already been used. Choose another.
Password: <current password>
passwd: Have exhausted maximum number of retries for service

The inablility to retry if you use an old password and this strange 'Password: ' are the only problem. Old passwords are stored in /etc/security/opasswd using their original hash function. It looks like

  1. pam_pwhistory can't retry because it's in the middle of the stack?

  2. A failure in pam_pwhistory doesn't cause pam_unix to fail, it instead prompts user?

I am on a CentOS 6.3

share|improve this question

migrated from stackoverflow.com Mar 18 at 21:28

This question came from our site for professional and enthusiast programmers.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.