Why is 8 numbers considered a "strong" password?

Question

Just curious as to why 8 numbers are accepted as a password in linux (CentOS if it matters) and not 8 characters on a non-dictionary word.

It's 10 vs 26 per digit after all. (52 counting CaSe SeNsItIvE)

Answer 1

It all depends on pam settings. If someone required at least 1 number in password it would match 8 digits but not 8 letters - it is very common requirement as people do choose highly secure password like name of wife ;) and name of wife + number have higher security.

It is not inherit property of Linux or unix and admin can easily change it.

Answer 2

Looking at obscure.c from the shadow-4.1.4.2 sources, we find:

/*
 * The scam is this - a password of only one character type
 * must be 8 letters long.  Two types, 7, and so on.
 */

I expect that the design decision had a lot to do with the social engineering factor that forcing people to invent arbitrarily difficult passwords is a great way to have them tape it to their screen.

The password "goodness" measure is coded to do things like

#ifdef HAVE_LIBCRACK
    /*
     * Invoke Alec Muffett's cracklib routines.
     */

and other such measures if the system builder desires them. From this I conclude the authors very likely understood what they were doing when considering the issue broadly.