How to set a password that violates password constraints without changing constraints using sudo

Question

I have root access on a machine shared by others. I think the password constraints are absurd, they are overly excessive in how they mandate the use and ordering of non word characters and make passwords slow to type due to the constant need to use special characters breaking up the password (even though I type I'm always minutely slower with special characters, it seems to break my flow). I can create a long & secure password without the constraints. I want to use my root access to circumvent the password rules to create a password I like and can type quickly.

However, I don't want to change the password constraints themselves. Or more accurately I DO want to change them, I think they are idiotic and don't actually add to security as written, but I shouldn't change them since that is being regulated by a higher authority.

Is there a way I can exploit my root access to set a password that violates these constraints without changing the constraints for anyone else on the system?

Answer 1

You could try printf "%s\n" 'username:encryptedpassword' | sudo chpasswd -e - that may be able to bypass the password checking enforced by PAM.

The password must be pre-encrypted, e.g. as in the mkpasswd example by muru. For example:

p=$(mkpasswd -m sha-512 'mysupersekretpassword')
printf "%s:%s\n" 'username' "$p" | sudo chpasswd -e

I'm using printf here rather than echo because echo will interpret and change the ouput for some character sequences that may occur in the crypted password, e.g. \t, \n, \nnn (3-digit octal) and others.

Remember to delete the mkpasswd command from your .bash_history. Or use export HISTCONTROL=ignorespace and prefix the p=$(...) command with a space so it never gets stored in the history. If you are not using bash, use whichever method is appropriate for your shell.

Answer 2

You can manually change password as admin. Just login and do the following:

Input:

# passwd whitecat

Output should be:

Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully

Answer 3

There might be other, safer methods, but one way is to edit /etc/shadow. Get the encrypted form of your intended password:

$ mkpasswd -m sha-512
Password: 
$6$zGvnR7mWtj59LfpO$t/VMNTbqyp9ykVMWUhsXghVvJ15iGDiFwvhNYaJIbBy8iM9E/vHSTmbBa0iotCLBA.MGBM949tyoxrjX81Qkg1

That's encrypted form of foo, in case you're wondering.

Edit /etc/shadow:

sudo vipw -s

Find your user, replace your current password with the one generated, save and quit. If you mess up, it will be hell, so keep a sudo session running in another terminal.