0

I installed Ubuntu 18.04 and manually modified /etc/security/pwquality.conf with the following settings:

minlen = 14
minclass = 4 

(without # at the start of the line).

However, when I add a new user and enter "123" in the New password prompt, it displays the following message:

BAD PASSWORD: The password is shorter than 14 characters
Retype new password:

The problem is that if I enter "123" again it says:

Password has been already used.

passwd: password updated successfully

and so I able to set the new password as "123" ignoring the minlen setting.

Why the setting is ignored?

edit:

I edited the /etc/security/pwquality.conf:

# Configuration for systemwide password quality limits
# Defaults:
#
# Number of characters in the new password that must not be present in the
# old password.
# difok = 1
#
# Minimum acceptable size for the new password (plus one if
# credits are not disabled which is the default). (See pam_cracklib manual.)
# Cannot be set to lower value than 6.
minlen = 14
#
# The maximum credit for having digits in the new password. If less than 0
# it is the minimum number of digits in the new password.
# dcredit = 0
#
# The maximum credit for having uppercase characters in the new password.
# If less than 0 it is the minimum number of uppercase characters in the new
# password.
# ucredit = 0
#
# The maximum credit for having lowercase characters in the new password.
# If less than 0 it is the minimum number of lowercase characters in the new
# password.
# lcredit = 0
#
# The maximum credit for having other characters in the new password.
# If less than 0 it is the minimum number of other characters in the new
# password.
# ocredit = 0
#
# The minimum number of required classes of characters for the new
# password (digits, uppercase, lowercase, others).
minclass = 4
#
# The maximum number of allowed consecutive same characters in the new password.
# The check is disabled if the value is 0.
# maxrepeat = 0
#
# The maximum number of allowed consecutive characters of the same class in the
# new password.
# The check is disabled if the value is 0.
# maxclassrepeat = 0
#
# Whether to check for the words from the passwd entry GECOS string of the user.
# The check is enabled if the value is not 0.
# gecoscheck = 0
#
# Whether to check for the words from the cracklib dictionary.
# The check is enabled if the value is not 0.
# dictcheck = 1
#
# Whether to check if it contains the user name in some form.
# The check is enabled if the value is not 0.
# usercheck = 1
#
# Whether the check is enforced by the PAM module and possibly other
# applications.
# The new password is rejected if it fails the check and the value is not 0.
enforcing = 1
#
# Path to the cracklib dictionaries. Default is to use the cracklib default.
# dictpath =
enforce_for_root

(tried to add the enforce_for_root line and uncomment the enforcing=1 line). Still get the same problem

1 Answer 1

0

If you are in a root shell and setting the password after creating the user, then in order for the settings in /etc/security/pwquality.conf to take effect, you need to uncomment the line near the bottom.

enforce_for_root

With it commented out, the settings will only apply to regular users. Even without that, if you were to try to change the password as that user, it would fail with the message that it is shorter than 14 characters and any other requirements that weren't met. In your case, simply uncomment the line above.

3
  • I don't have this line in the file (commented nor un-commented) but I saw this part: # Whether the check is enforced by the PAM module and possibly other # applications. # The new password is rejected if it fails the check and the value is not 0. # enforcing = 1 is that relevant? (I apologies, I don't know how to format comments)
    – hutcruchi
    Jun 7, 2023 at 13:54
  • @hutcruchi Have you tried setting the password as the user and seeing what occurs and then adding then adding the line in my answer and trying it as root? Jun 7, 2023 at 15:49
  • I don't use root user at all. I have the admin user (the one created with the initial Ubuntu 18.04 setup) which executes sudo useradd <user_name>. I got the same result before and after adding your line
    – hutcruchi
    Jun 7, 2023 at 19:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .