PASS_MIN_LEN missing from login.defs

Question

I've noticed that the PASS_MIN_LEN is missing from the password aging controls section inside /etc/login.defs (Ubuntu 20.04 LTS). At the end of the file there is a note that it's obsolete, alongside other options, and someone needs to edit the appropriate file in /etc/pam.d directory.

################# OBSOLETED BY PAM ##############
#                       #
# These options are now handled by PAM. Please  #
# edit the appropriate file in /etc/pam.d/ to   #
# enable the equivelants of them.
#
###############

But even if I cat /etc/pam.d/* | grep "PASS_MIN_LEN" I still cannot find this option!

What's up with that?

Answer 1

Pluggable Authentication Modules (PAM) is a (not really) newer generic API for authentication originally proposed by Sun Microsystems in 1995 and adapted a year later on the Linux ecosystem. With an API change, don't expect things to keep the same name (nor to always map exactly the same).

from man pam_unix:

OPTIONS

[...]

minlen=n
Set a minimum password length of n characters. The default value is 6. The maximum for DES crypt-based passwords is 8 characters.

Implementation can vary from distribution to distribution. On Ubuntu (like on Debian), /etc/pam.d/passwd will source /etc/pam.d/common-password where the first password occurence includes the useful options. It can be altered and have an minlen=X parameter added. This later file is autoregenerated by pam-auth-update typically on upgrades, so check it works after an upgrade of PAM-related packages. Normally it should:

The script makes every effort to respect local changes to /etc/pam.d/common-*. Local modifications to the list of module options will be preserved, and additions of modules within the managed portion of the stack will cause pam-auth-update to treat the config files as locally modified and not make further changes to the config files unless given the --force option.

Other options might still affect the result. Eg, if you set minlen=1, the obscure option will still reject a one-letter password as a palindrome, or a 2-letters password as too simple etc.

Be careful when altering PAM: you might lock yourself out of your system in case of wrong settings.