8

After setting password expiration via:

sudo chage -d 0 username

Then changing the password and login as that user.

When I type "passwd" and try to set the original password I receive message;

"Password Policy - BAD PASSWORD: The password is just rotated old one"

I've had a look in the following file but can't see a policy line item that could cause this behaviour;

sudo nano /etc/pam.d/common-password

# here are the per-package modules (the "Primary" block)
password        requisite                       pam_pwquality.so retry=3
password        [success=2 default=ignore]      pam_unix.so obscure use_authtok try_first_pass yesc>
password        sufficient                      pam_sss.so use_authtok
# here's the fallback if no module succeeds
password        requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password        required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
password        optional        pam_gnome_keyring.so
password        optional        pam_ecryptfs.so
# end of pam-auth-update config

What is causing the "BAD PASSWORD: The password is just rotated old one" error message?

Cheers!

3
  • 5
    @Robbie Goodwin This is not a "Why?" question, it is a "How?" question. How would this be suppressed, say, or how many generations (last 10 say) are configured?
    – mckenzm
    Jul 30, 2022 at 22:42
  • 1
    @RobbieGoodwin In context, the question is not "What does this error message mean?" but rather "Which component of the OS is responsible for producing this error?"
    – zwol
    Jul 31, 2022 at 18:34
  • @RobbieGoodwin I don't see how you could possibly read it any other way.
    – zwol
    Aug 6, 2022 at 3:01

3 Answers 3

Reset to default
11

pam_pwquality causes this, having an exact match for the error message:

    case PWQ_ERROR_ROTATED:
            return _("The password is just rotated old one");

There does not appear to be an option to disable this feature via the pwquality.conf(5) configuration file. And even if pam_pwquality were disabled (probably a bad idea, attackers love it when passwords do not change, or do not change much) then pam_unix might also reject the password for reasons of its own.

6
  • 1
    Attackers don't much care if passwords change or not -- typically, the first thing an attacker will do upon discovering a password is to secure their access against password changes. If they don't, it's usually because they only need one-time access (eg. draining your bank account).
    – Mark
    Jul 30, 2022 at 22:18
  • 2
    Current best practise is against regular password rotation. The body of evidance is that it just encourages users to weaken their passwords, which increases the risk of a password being broken: schneier.com/blog/archives/2016/08/frequent_passwo.html
    – user1937198
    Jul 31, 2022 at 17:05
  • Hypothetically users pick weak passwords and hypothetically they demand SMTP AUTH so they can send remote messages and hypothetically the weak passwords get hacked by all that hypothetical brute forcing, so in practice passwords must be rotated and ideally must not be something very similar to their existing password. Variations on existing passwords would be trivial and obvious for any attacker to try.
    – thrig
    Jul 31, 2022 at 17:25
  • 3
    @thrig Yeah, and the point of the research summarized at that link is that forced password changes make your hypothetical scenario worse.
    – zwol
    Jul 31, 2022 at 18:36
  • @zwol If the user account is being used to send spam, then a forced password change is mandatory, and ideally that password should not be similar to the prior. Which pwquality can help with. Otherwise, I'm not sure what point you are trying to make... where exactly did I argue that passwords should be changed for no other reason than the passage of time?
    – thrig
    Jul 31, 2022 at 18:51
9

It's probably the obscure parameter for pam_unix.so. From man 8 pam_unix:

   obscure
      Enable some extra checks on password strength. These checks are
      based on the "obscure" checks in the original shadow package. The
      behavior is similar to the pam_cracklib module, but for
      non-dictionary-based checks. The following checks are implemented:

      [...descriptions of other checks cut out for brevity...]

      Rotated
          Is the new password a rotated version of the old password?
          (E.g., "billy" and "illyb")

pam_unix.so's primary purpose is to handle the /etc/passwd and /etc/shadow files, but it also includes the capability to do some basic password quality checks.

The pam_pwquality.so is another module that might be doing password quality checks.

0

I would interpret "Password Policy - BAD PASSWORD: The password is just rotated old one" to mean that you are trying to use a previously used password.

The error message isn't crystal clear, though.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .