1

I have the following settings in file /etc/pam.d/common-password.

password        requisite                       pam_cracklib.so retry=3 lcredit=-1 ucredit=-1 dcredit=-1
password        [success=1 default=ignore]      pam_unix.so obscure use_authtok try_first_pass sha512
password        requisite                       pam_deny.so
password        required                        pam_permit.so
password        optional        pam_ecryptfs.so

Why can root set a weak password for another user?

root@kali:~# LANG=C passwd kali
New password: 
BAD PASSWORD: it is WAY too short
BAD PASSWORD: is a palindrome
Retype new password: 
passwd: password updated successfully

I don't see any pam rule that is allowing it. Am I missing something?

1 Answer 1

5

In newer (and backported into RHEL 6) versions of PAM, there is an option to pam_cracklib you want to add — enforce_for_root. This is off by default. Just add it to that line, and there you go.

Of course, without a lot of other constraints (SELinux, say), root can always go around PAM and set the password another way (like, writing directly to the appropriate file), so consider this more of a way of keeping yourself honest rather than solid restriction.

Why does it work this way rather than expecting the stack to take care of that kind of thing? I think it's just a matter of flexibility, especially back when the PAM control values were just the simple required/requisite/sufficient/optional — you'd have to put pam_rootok with a control value of sufficient above all of the checks that root would ignore, but only those. Since the option to succeed as root is built into pam_cracklib itself, that's not necessary (assuming that allowing root to skip the check is desired, which it apparently is, even if not in your case).

5
  • I understand that this behaviour makes sense. But I don't know if it's a matter of an operating system or a pam issue. If it's a pam thing I don't understand the sense of rootok.
    – sebelk
    Jun 10, 2015 at 1:10
  • @sebelk Oh, it's all a pam issue. Edited to explain more — hope this helps.
    – mattdm
    Jun 10, 2015 at 1:20
  • Ok I've found that enforce_for_root is absent in pam v1.1.3
    – sebelk
    Jun 10, 2015 at 2:11
  • @sebelk Whoo, flashback. Sorry, I live in Fedora and forget. :)
    – mattdm
    Jun 10, 2015 at 3:00
  • @sebelk Looks like this was backported into RHEL6 in 2013. There's a patch there you could use elsewhere.
    – mattdm
    Jun 10, 2015 at 3:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .