I have the following settings in file /etc/pam.d/common-password.

password        requisite                       pam_cracklib.so retry=3 lcredit=-1 ucredit=-1 dcredit=-1
password        [success=1 default=ignore]      pam_unix.so obscure use_authtok try_first_pass sha512
password        requisite                       pam_deny.so
password        required                        pam_permit.so
password        optional        pam_ecryptfs.so

Why can root set a weak password for another user?

root@kali:~# LANG=C passwd kali
New password: 
BAD PASSWORD: it is WAY too short
BAD PASSWORD: is a palindrome
Retype new password: 
passwd: password updated successfully

I don't see any pam rule that is allowing it. Am I missing something?


In newer (and backported into RHEL 6) versions of PAM, there is an option to pam_cracklib you want to add — enforce_for_root. This is off by default. Just add it to that line, and there you go.

Of course, without a lot of other constraints (SELinux, say), root can always go around PAM and set the password another way (like, writing directly to the appropriate file), so consider this more of a way of keeping yourself honest rather than solid restriction.

Why does it work this way rather than expecting the stack to take care of that kind of thing? I think it's just a matter of flexibility, especially back when the PAM control values were just the simple required/requisite/sufficient/optional — you'd have to put pam_rootok with a control value of sufficient above all of the checks that root would ignore, but only those. Since the option to succeed as root is built into pam_cracklib itself, that's not necessary (assuming that allowing root to skip the check is desired, which it apparently is, even if not in your case).

| improve this answer | |
  • I understand that this behaviour makes sense. But I don't know if it's a matter of an operating system or a pam issue. If it's a pam thing I don't understand the sense of rootok. – sebelk Jun 10 '15 at 1:10
  • @sebelk Oh, it's all a pam issue. Edited to explain more — hope this helps. – mattdm Jun 10 '15 at 1:20
  • Ok I've found that enforce_for_root is absent in pam v1.1.3 – sebelk Jun 10 '15 at 2:11
  • @sebelk Whoo, flashback. Sorry, I live in Fedora and forget. :) – mattdm Jun 10 '15 at 3:00
  • @sebelk Looks like this was backported into RHEL6 in 2013. There's a patch there you could use elsewhere. – mattdm Jun 10 '15 at 3:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.