3

I have root access on a machine shared by others. I think the password constraints are absurd, they are overly excessive in how they mandate the use and ordering of non word characters and make passwords slow to type due to the constant need to use special characters breaking up the password (even though I type I'm always minutely slower with special characters, it seems to break my flow). I can create a long & secure password without the constraints. I want to use my root access to circumvent the password rules to create a password I like and can type quickly.

However, I don't want to change the password constraints themselves. Or more accurately I DO want to change them, I think they are idiotic and don't actually add to security as written, but I shouldn't change them since that is being regulated by a higher authority.

Is there a way I can exploit my root access to set a password that violates these constraints without changing the constraints for anyone else on the system?

4

You could try printf "%s\n" 'username:encryptedpassword' | sudo chpasswd -e - that may be able to bypass the password checking enforced by PAM.

The password must be pre-encrypted, e.g. as in the mkpasswd example by muru. For example:

p=$(mkpasswd -m sha-512 'mysupersekretpassword')
printf "%s:%s\n" 'username' "$p" | sudo chpasswd -e

I'm using printf here rather than echo because echo will interpret and change the ouput for some character sequences that may occur in the crypted password, e.g. \t, \n, \nnn (3-digit octal) and others.

Remember to delete the mkpasswd command from your .bash_history. Or use export HISTCONTROL=ignorespace and prefix the p=$(...) command with a space so it never gets stored in the history. If you are not using bash, use whichever method is appropriate for your shell.

2

You can manually change password as admin. Just login and do the following:

Input:

# passwd whitecat

Output should be:

Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
  • I tried this before writing you. Even with sudo it prompts me for an old password, which I can provide, and forces password constraints on me. I assume they have modified the passwd command in some way, configuration file, alias etc, to prevent this. – dsollen Nov 12 '15 at 19:42
  • 1
    I don't think this is possible besides the method written by @muru. The same problem is discussed in question askubuntu.com/questions/180402/…, and no comment had any other idea other than change the password constraint file. If you add this as something you tried to the question I will delete it as an answer. – Whitecat Nov 12 '15 at 20:36
2

There might be other, safer methods, but one way is to edit /etc/shadow. Get the encrypted form of your intended password:

$ mkpasswd -m sha-512
Password: 
$6$zGvnR7mWtj59LfpO$t/VMNTbqyp9ykVMWUhsXghVvJ15iGDiFwvhNYaJIbBy8iM9E/vHSTmbBa0iotCLBA.MGBM949tyoxrjX81Qkg1

That's encrypted form of foo, in case you're wondering.

Edit /etc/shadow:

sudo vipw -s

Find your user, replace your current password with the one generated, save and quit. If you mess up, it will be hell, so keep a sudo session running in another terminal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.