6

I installed a Linux based system with a blank password. I wanted to change password to something simple, but using passwd and setting the password to something like a single symbol gave an error of “password being a palindrome”.

How to disable password complexity checks?

2

4 Answers 4

6

I found out my system (as most modern Linux) use PAM (Pluggable Authentication Modules) and pam_cracklib module within it. pam_cracklib enforces minimum length of 6 symbols regardless of parameters, so solution is to turn it off.

One link I've read discussed editing password-ac and system-ac files in /etc/pam.d, the contents of both files were same and no explanation was given of their respective roles.

Upon study of PAM docs (The Linux-PAM System Administrators' Guide | linux-pam.org), I learned PAM configs for LINUX services are in that /etc/pam.d directory in separate files. I saw passwd file and it in found only system-ac file mentioned (added by substack keyword), so on my system I needed to edit only system-ac.

Making pam_cracklib optional made no difference (I guess that's because pam_cracklib did not pass entered and rejected pasword to next module in stack - pam_unix) and commenting line with pam_cracklib lead to errors during passwd run. I noted that next line with ordinary pam_unix had option use_authtok (docs: enforce the module to set the new password to the one provided by a previously stacked module). After I deleted that option and commented line with pam_cracklib I now able to set short passwords with passwd.

1

There are a couple of PAM modules that can do password strength checking. There's at least pam_cracklib that comes with many distributions, and pam_passwdqc from Openwall (packaged in e.g. Debian). Also, some versions of the usual file-based authentication module pam_unix have options that are related to password strength, like minlen for minimum password length, and obscure which makes some tests to compare the new password to the old one. (The name comes from 'the "obscure" checks in the original shadow package'.)

You'll need to check your PAM config for any such modules, and either disable or uninstall them. Look for lines starting with the keyword password for the modules related to password changes. The exact structure of the the configuration may depend on the distribution.

Also, if you have users stored on LDAP or other such network based system, it's not impossible for the server itself to have requirements for the user password. In this case, the PAM configuration on the client would not be relevant. E.g. OpenLDAP has a password policy overlay module.

1
  • In my current Gentoo/Linux box I change my password with the standard passwd command. I have found the relevant PAM configuration in /etc/pam.d/passwd, which include system-auth, that is /etc/pam.d/system-auth. In there password required pam_passwdqc.so config=/etc/security/passwdqc.conf points me to the final configuration file in this trip. man passwdqc.conf explains that I can let root user free by editing enforce=users (instead of the existing everyone) in there.
    – Hamlet
    Nov 27, 2021 at 20:19
1

in /etc/pam.d/common-password change this line:

password requisite pam_pwquality.so retry=3

to

password requisite pam_pwquality.so dictcheck=0 retry=3 

means set dictcheck=0, it will ignore the dictionary check

0
sudo apt autoremove libpam-sss

problem solved

1
  • Hi, welcome to U&L. I think this answer is too short and a bit flippant, as there are other implications to just removing the libpam-sss package that are not explained - I can think of /etc/nssswitch.conf entries from the top of my head. Would you be able to explain these?
    – user123570
    Apr 14, 2023 at 14:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .