0

I've noticed that the PASS_MIN_LEN is missing from the password aging controls section inside /etc/login.defs (Ubuntu 20.04 LTS). At the end of the file there is a note that it's obsolete, alongside other options, and someone needs to edit the appropriate file in /etc/pam.d directory.

################# OBSOLETED BY PAM ##############
#                       #
# These options are now handled by PAM. Please  #
# edit the appropriate file in /etc/pam.d/ to   #
# enable the equivelants of them.
#
###############

But even if I cat /etc/pam.d/* | grep "PASS_MIN_LEN" I still cannot find this option!

What's up with that?

1

Pluggable Authentication Modules (PAM) is a (not really) newer generic API for authentication originally proposed by Sun Microsystems in 1995 and adapted a year later on the Linux ecosystem. With an API change, don't expect things to keep the same name (nor to always map exactly the same).

from man pam_unix:

OPTIONS

[...]

minlen=n
Set a minimum password length of n characters. The default value is 6. The maximum for DES crypt-based passwords is 8 characters.

Implementation can vary from distribution to distribution. On Ubuntu (like on Debian), /etc/pam.d/passwd will source /etc/pam.d/common-password where the first password occurence includes the useful options. It can be altered and have an minlen=X parameter added. This later file is autoregenerated by pam-auth-update typically on upgrades, so check it works after an upgrade of PAM-related packages. Normally it should:

The script makes every effort to respect local changes to /etc/pam.d/common-*. Local modifications to the list of module options will be preserved, and additions of modules within the managed portion of the stack will cause pam-auth-update to treat the config files as locally modified and not make further changes to the config files unless given the --force option.

Other options might still affect the result. Eg, if you set minlen=1, the obscure option will still reject a one-letter password as a palindrome, or a 2-letters password as too simple etc.

Be careful when altering PAM: you might lock yourself out of your system in case of wrong settings.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.