2

Using RHEL6

Within the file /etc/pam.d/system-auth I have the following setting:

difok=4

However I am able to successfully change root's password from abcd1 to bbcd1

It seems like I should not be able to do this as the new password is not 4 characters different from the original.

Is this expected?

If it is expected, is there any way to place password complexity restrictions on the root account?

Improve this question
2
  • 1
    I don't think so. Root is allowed to bypass all password requirements.
    – jesse_b
    Commented Dec 20, 2017 at 18:35
  • @Jesse_b, so not even min/max length for root password? Only expiration?
    – Igor
    Commented Dec 20, 2017 at 18:37

1 Answer 1

Reset to default
1

Assuming you are using pam_pwquality (it is not clear from your post, and difok appears to be used by a variety of different PAM modules per a web search) then root checks skip this test because there is no old password to compare against:

   enforce_for_root
       The module will return error on  failed  check  even  if  the  user
       changing  the password is root. This option is off by default which
       means that just the message about the failed check is  printed  but
       root  can  change  the password anyway. Note that root is not asked
       for an old password so the checks that  compare  the  old  and  new
       password are not performed.

This quote is from the pam_pwquality(8) man page on a centos7 system.

Improve this answer
1
  • thank you. No, we are not using pam_pwquality. But that quote does help a lot.
    – Igor
    Commented Dec 20, 2017 at 22:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .