4

I know that on Linux (at least debian) every password are hashed and stored in /etc/shadow.

However thanks to the libpam-cracklib you can add some rules on passwords. For instance in /etc/pam.d/common-password you can set Difok which is a parameter that indicate the number of letter that can be the same between an old and a new password.

But how linux can know when I type in an new password the similarity with my old pasword as it doesn't know my real password (it just have a hash)?

Thanks !

Improve this question
1
  • Probably tries all passwords that are just a few letters away from the new one. If it does not find a match, then the new one is different enough.
    – ctrl-alt-delor
    Commented Oct 11, 2017 at 15:18

1 Answer 1

Reset to default
3

When you ask a PAM module to change a password (or participate in changing a password), the module can retrieve both the new password and the old, as given by the user: as Christopher points out, passwd asks for the old password as well as the new (unless you’re running it as root and changing another user’s password). The module can use that information to compare both passwords, without having to somehow reverse the current hash or enumerate variants.

The PAM functions involved include pam_sm_chauthtok and pam_get_item, whose documentation (and the other pages referenced there) should help you understand what’s going on. You can see how it’s done in libpam-cracklib’s source code.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .