Just curious as to why 8 numbers are accepted as a password in linux (CentOS if it matters) and not 8 characters on a non-dictionary word.

It's 10 vs 26 per digit after all. (52 counting CaSe SeNsItIvE)

2 Answers 2


It all depends on pam settings. If someone required at least 1 number in password it would match 8 digits but not 8 letters - it is very common requirement as people do choose highly secure password like name of wife ;) and name of wife + number have higher security.

It is not inherit property of Linux or unix and admin can easily change it.


Looking at obscure.c from the shadow- sources, we find:

 * The scam is this - a password of only one character type
 * must be 8 letters long.  Two types, 7, and so on.

I expect that the design decision had a lot to do with the social engineering factor that forcing people to invent arbitrarily difficult passwords is a great way to have them tape it to their screen.

The password "goodness" measure is coded to do things like

     * Invoke Alec Muffett's cracklib routines.

and other such measures if the system builder desires them. From this I conclude the authors very likely understood what they were doing when considering the issue broadly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.