45

I am trying to change my current password in Red Hat Enterprise Linux Server release 5.10 (Tikanga) but it says my new password is too similar. Is there any way to force change ?

$ passwd
Changing password for user XY
Changing password for XY
(current) UNIX password:
New UNIX password:
BAD PASSWORD: is too similar to the old one
New UNIX password:
7
  • 1
    Duplicate: superuser.com/questions/130922/…
    – darnir
    Sep 17, 2014 at 8:06
  • I did not want to change to same password. let say I have Bilbo1 and I want to change to Bilbo2, I get message above: "BAD PASSWORD: is too similar to the old one"... SO I am not changing to same password
    – To Kra
    Sep 17, 2014 at 11:56
  • 1
    If you had bothered to read the answers to that question, you'd have realized why you're in the same position and how to resolve your problem.
    – darnir
    Sep 18, 2014 at 9:18
  • 2
    IMHO that mentioned question has no really clear answer.
    – To Kra
    Sep 19, 2014 at 9:59
  • @darnir, duplicates are when the question is already asked in same SO site. This one can not be a duplicate :)
    – Ramesh
    Sep 19, 2014 at 16:18

5 Answers 5

69

If you can run the command as root, you can force the change to be accepted.

Example:

$ sudo passwd myusername
Changing password for user myusername.
New password: 
Retype new password: 
passwd: all authentication tokens updated successfully.
3
  • 2
    This is the perfect answer Oct 3, 2018 at 19:03
  • Works with still warnings.
    – Sandburg
    Apr 30, 2019 at 15:58
  • If the user had super user access, they might as well change whatever settings enables these silly password restrictions. Since they are not asking about this, I'm assuming they do not have root access.
    – Kusalananda
    Mar 29, 2021 at 7:09
11

Short answer: You can't.

work around:

  • change twice, e.g. old passwd is Bilbo1,

    • change to Frodo1 (from Bilbo1),

    • then change to Bilbo2 (from Frodo1).

why two changes ?

  • on the first change, Linux can only compare clear text Bilbo1 and Frodo1,

  • on second Linux can only compare Frodo1 and Bilbo2 (and all the crypted passwd, you can't revert to Bilbo1(*)).

  • This suppose you can change twice, which may have been disable by your system admin, to prevent such work arround.

Needless to say, do not use such a silly password.

(*) On second tought, I am not sure about this point in Linux.

6
  • I did not want to change to same password. let say I have Bilbo1 and I want to change to Bilbo2, I get message above: "BAD PASSWORD: is too similar to the old one"... SO I am not changing to same password
    – To Kra
    Sep 17, 2014 at 11:57
  • Well, did yo umanaged to change from Bilbo1 to Bilbo2 using Frodo1 between ?
    – Archemar
    Sep 17, 2014 at 12:24
  • 5
    well, while trying change from Frodo1 to Bilbo2 I got message that: "You must wait longer to change your password" LOL
    – To Kra
    Sep 18, 2014 at 8:29
  • that was my third point. my favourite password pattern is Bilbo00 / Frodo00 with 00 the current month.
    – Archemar
    Sep 18, 2014 at 8:34
  • 2
    normally I use pattern: bilbo0000BAGGINS
    – To Kra
    Sep 18, 2014 at 8:42
3

On CentOS, you can also use the -f option to force the password change.

$ passwd -f username
Changing password for user username.
New password: 
Retype new password:
2
  • this doesn't work in Ubuntu 19.10, there is no -f option. Jan 7, 2020 at 13:30
  • 2
    Since passwd uses PAM, you would have to modify the file: /etc/pam.d/common-password on Debian based systems like Ubuntu, or /etc/pam.d/system-auth on RedHat based systems.
    – Will AE
    Jan 8, 2020 at 15:24
2

The other answers solve the problem for most users. However, if you're an admin using a Linux system with PAM, and want this policy removed for all users to change their password without needing to use sudo or root, then this needs to be changed in the PAM settings.

I don't know about RHEL, but on Ubuntu, you can edit /etc/pam.d/common-password. There should be a line somewhere like this

password    [success=1 default=ignore]  pam_unix.so obscure use_authtok try_first_pass sha512

The obscure keyword tells PAM to do a series of checks that compares the new password to the old password, and makes sure that the new password is different enough from the old one in the following ways

  • The new password is not a palindrome of the old one
  • The new password isn't just a case change of the old one
  • The new password isn't too much like the previous one (the issue here)
  • The password isn't too simple
  • The password isn't just a rotated version of the old one

More information can be found in man pam_unix

Removing this keyword and refreshing PAM would mean that the checks will not be done anymore. However, keep in mind that this may encourage bad passwords to be used and may affect the security of your system.

1
  • Thanks. I don't need some defaults telling me how secure my network needs to be! Oct 29, 2021 at 5:39
0

Try:
sudo busybox passwd XY
(XY is your user name)

I have used the root privilege to set a weak password for a normal user, with a warning, but it worked in the end.
But I tried again recently and it failed.
My final solution is to use busybox's internal passwd program, which is a different program, and it works.

My system is gentoo, and after checking, the default passwd is from sys-apps/shadow-4.8.1-r2.

duke@duke-pc ~ $ sudo passwd duke

You can now choose the new password or passphrase.

A good password should be a mix of upper and lower case letters,
digits, and other characters.  You can use a password
that consists of 8 characters.

A passphrase should be of at least 3 words, 8 to 40 characters
long, and contain enough different characters.

Alternatively, if no one else can see your terminal now, you can
pick this as your password: "sleep=Medal2brim".

Enter new password: 
Weak password: too short.
Try again.

(....)

You can now choose the new password or passphrase.

A good password should be a mix of upper and lower case letters,
digits, and other characters.  You can use a password
that consists of 8 characters.

A passphrase should be of at least 3 words, 8 to 40 characters
long, and contain enough different characters.

Alternatively, if no one else can see your terminal now, you can
pick this as your password: "Freeze+six7nazi".

Enter new password: 
Weak password: based on a dictionary word and not a passphrase.
passwd: Authentication token manipulation error
passwd: password unchanged
duke@duke-pc ~ $ 
duke@duke-pc ~ $ sudo busybox passwd duke
Changing password for duke
New password: 
Bad password: too weak
Retype password: 
passwd: password for duke changed by root
duke@duke-pc ~ $ 
1
  • 1
    @AdminBee OK, more descriptions have been added.
    – dukelec
    Jan 29, 2021 at 7:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .