Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

I want to set the system-wide password policy on an Ubuntu 12.04 LTS server. Googling around, a lot of people point to this (very old) document:

It says to edit the /etc/pam.d/common-password file and look for the password required line:

password    required nullok obscure min=6 max=8 md5

To set the minimum password length, adjust the min= setting.

However, on 12.04, my file looks like this (comments removed):

password    [success=1 default=ignore] obscure sha512
password    requisite 
password    required  

Which line do I change? The one with Or the one with password required? Or is it now in some other file? There's nothing in that file's comments about setting the password policies.

share|improve this question

2 Answers 2

You need to change the first line password [success=1 default=ignore] obscure sha512

But don't use md5 since the new one is using sha512. If you want to set a minimum password length (8) use the line below

password        [success=2 default=ignore] obscure sha512 min=8
share|improve this answer

pam_unix is the PAM module that handles authentication with a user name and password, so that's where you would configure a password policy.

In the PAM configuration, the first column indicates the management group. Here, it's password, which configures updates of users' authentication data. The second column specifies the control flow between the different modules, don't touch it unless you know what you're doing. The third column is the module name and the subsequent columns are parameters to this module.

Look in the pam_unix documentation, or better in the pam_unix man page on your system, to see what options are supported. Add the options you want, e.g.

password    [success=1 default=ignore] obscure sha512 rounds=10000 minlen=8

You might want to add other modules to perform complexity checks on the password, such as pam_cracklib. Set pam_cracklib as required and put it before pam_unix (which validates the password change):

password    required           retry=3 difok=1 minlen=10
password    [success=1 default=ignore] obscure sha512 rounds=10000 minlen=8
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.