3

On my Amazon Linux (RHEL-derived) system, within /etc/login.defs, I've set the minimum number of days between password changes to 1 day: PASS_MIN_DAYS 1.

I thought I should be doing that with PAM configuration files in /etc/pam.d/. However, I cannot find any documentation for doing so. Is there a way to control when passwords can be changed using PAM, and what is it, please?

1

Setting user Specific password policy:

One option is to modify user password policy - using lchage command.

Below command will set minimum number of days required between pasword changes.

lchage --mindays=<days> <username>

Below command can be used to see current policy

lchage --list <username>

Common Policy for All users:

To set password policy common for all users in system, you need to edit PASS_MIN_DAYS variable in /etc/login.defs file.

root@ubuntu:~# grep PASS_MIN_DAYS /etc/login.defs 
#   PASS_MIN_DAYS   Minimum number of days allowed between password changes.
PASS_MIN_DAYS   1

Above grep listing shows minimum # days required between password changes is 1.

If user tries to reset password before minimum # days set, he/she will get error as listed below.

$ passwd
Changing password for test.
(current) UNIX password: 
You must wait longer to change your password
passwd: Authentication token manipulation error
passwd: password unchanged

While creating user, policy defined in /etc/login.defs will be applicable to user being created. Again lchage --list command can be used to see current policy.

  • This is specifically the password policy for a specific user, right? I'm concerned with the policy applied to all users, which would be significant the next time a new user is added (likely when I leave and a new admin comes on board). – Michael Greisman Sep 10 '15 at 20:06
  • 1
    Yes Michael , chage is to set policy for specific user. I will edit answer regarding common policy for all users. – Shubhangi Sep 14 '15 at 17:05
1

You raise an interesting question. Per the login.defs man page, the pass_min_days parameter is only applied to the user at account creation, so changes in /etc/pam.d would be preferable for consistency. However, to the best of my knowledge, the standard pam_unix module (and I guess to a lesser extent pam_cracklib.so) doesn't have any options relating to the date. There's also chage, which manipulates /etc/shadow, nothing in /etc/pam.d/.

Ultimately, I think the answer is you can't manage this value via PAM arguments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.