I know that on Linux (at least debian) every password are hashed and stored in /etc/shadow.

However thanks to the libpam-cracklib you can add some rules on passwords. For instance in /etc/pam.d/common-password you can set Difok which is a parameter that indicate the number of letter that can be the same between an old and a new password.

But how linux can know when I type in an new password the similarity with my old pasword as it doesn't know my real password (it just have a hash)?

Thanks !

  • Probably tries all passwords that are just a few letters away from the new one. If it does not find a match, then the new one is different enough. – ctrl-alt-delor Oct 11 '17 at 15:18

When you ask a PAM module to change a password (or participate in changing a password), the module can retrieve both the new password and the old, as given by the user: as Christopher points out, passwd asks for the old password as well as the new (unless you’re running it as root and changing another user’s password). The module can use that information to compare both passwords, without having to somehow reverse the current hash or enumerate variants.

The PAM functions involved include pam_sm_chauthtok and pam_get_item, whose documentation (and the other pages referenced there) should help you understand what’s going on. You can see how it’s done in libpam-cracklib’s source code.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.