Using RHEL6.

I'm trying to test my changes to the "difok" parameter. I'm starting with the default value of 4 and then will change it to the one we require.

The line in the /etc/pam.d/system-auth looks like this:

password   requisite   pam_cracklib.so try_first_pass retry=3 type= minlen=1 difok=4 maxrepeat=3

And so I'm trying to change the password from "abcd2" to "fhim3" (those are just test passwords with the length of 5 characters). As you can see I'm changing more than 4 characters and the length of the new password is greater than 1 (minlen parameter).

Still after typing the new password I'm getting the BAD PASSWORD: password is too short message.

Trying to Google I see people are saying that minimum required length for the password is 6 on the RHEL. Is this what stopping the change? If it is - can I overwrite the default? If not - what am I missing?

This is for the regular user and not a root.

NB: The default password is forced into the system when we set it up.

NB2: The minlen parameter in the line above is overwritten by me to test. Actual value is bigger.

  • Related - Password Complexity Issue – roaima Dec 21 '17 at 0:15
  • @roaima, the one you reference is for the root account. This one is for the regular user. And it describes different problem. – Igor Dec 21 '17 at 17:04

Apparently, you can't set the minlen parameters to 1 ...

manpage for pam_cracklib

Note that there is a pair of length limits in Cracklib itself, a
"way too short" limit of 4 which is hard coded in and a defined limit (6)
that will be checked without reference to minlen. If you want to allow 
passwords as short as 5 characters you should not use this module.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.