I'm using ubuntu 18.04. To strengthen my pass-word policy I modify my /etc/pam.d/common-password like this:

# here are the per-package modules (the "Primary" block)
#password       requisite                       pam_cracklib.so retry=3 minlen=8 difok=3
password requisite pam_cracklib.so retry=3 minlen=8 difok=3 ucredit=-1 lcredit=-1 dcredit=-1
password        [success=1 default=ignore]      pam_unix.so obscure use_authtok try_first_pass sha512 remember=15
# here's the fallback if no module succeeds
password        requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password        required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config

At first when I tried to login to root using sudo -s there is no problem at all, but when I tried to login to root using sudo -s and entered my password I always get Sorry, try again.


The password lines in PAM configuration only take effect when you're trying to change your password. So your /etc/pam.d/common-password modification is extremely unlikely to be a factor in you not being able to switch to root using sudo.

If you had made any changes to PAM configuration lines beginning with keywords auth, account, or session, then it would be possible for your changes to have caused sudo to fail.

The auth lines tell the system how the identity of the user attempting to log in should be verified. ("How do I know it's you?")

The account lines deal with determining whether or not you will be allowed in once you've successfully authenticated: are there login time restrictions for you? Possibly a limit for a maximum number of consecutive logins per user? Is your account restricted to local logins only? Has the administrator blocked regular user logins with an /etc/nologin file (perhaps in order to get some major OS upgrade or disk space restructuring done)?

Once these checks have been passed, the session lines define the basic things the system needs to do to set up your session: things like applying ulimit restrictions, setting up a basic set of environment variables, recording your session to the utmp file, possibly granting you access to some hardware devices only if you are logging in locally.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.