Using RHEL6.

I'm trying to test my changes to the "difok" parameter. I'm starting with the default value of 4 and then will change it to the one we require.

The line in the /etc/pam.d/system-auth looks like this:

password   requisite   pam_cracklib.so try_first_pass retry=3 type= minlen=1 difok=4 maxrepeat=3

And so I'm trying to change the password from "abcd2" to "fhim3" (those are just test passwords with the length of 5 characters). As you can see I'm changing more than 4 characters and the length of the new password is greater than 1 (minlen parameter).

Still after typing the new password I'm getting the BAD PASSWORD: password is too short message.

Trying to Google I see people are saying that minimum required length for the password is 6 on the RHEL. Is this what stopping the change? If it is - can I overwrite the default? If not - what am I missing?

This is for the regular user and not a root.

NB: The default password is forced into the system when we set it up.

NB2: The minlen parameter in the line above is overwritten by me to test. Actual value is bigger.

  • Related - Password Complexity Issue Dec 21, 2017 at 0:15
  • @roaima, the one you reference is for the root account. This one is for the regular user. And it describes different problem.
    – Igor
    Dec 21, 2017 at 17:04

1 Answer 1


Apparently, you can't set the minlen parameters to 1 ...

manpage for pam_cracklib

Note that there is a pair of length limits in Cracklib itself, a
"way too short" limit of 4 which is hard coded in and a defined limit (6)
that will be checked without reference to minlen. If you want to allow 
passwords as short as 5 characters you should not use this module.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .