Avoid "Authentication token manipulation error" on password change

Question

I'm implementing a security policy that will force the users to introduce stricter passwords when they change their own:

The /etc/pam.d/passwd configuration file is:

#%PAM-1.0
auth     include    common-auth
account  include    common-account
password include    common-password
session  include    common-session

So, I made changes in this file /etc/pam.d/common-password.

The default common-password file comes with this two lines:

password    requisite   pam_pwcheck.so  nullok cracklib
password    required    pam_unix2.so    use_authtok nullok

I need to add several options to the pam_pwcheck (no problem with that) and another PAM module (pam_cracklib) to make the passwords stronger. Next, it is my final /etc/pam.d/common-password file, included from passwd:

password  requisite  pam_cracklib.so minclass=3 retry=3
password  requisite  pam_pwcheck.so  nullok cracklib minlen=10 remember=5
password  required   pam_unix2.so    use_authtok nullok

My problem occurs when I have both PAM modules configured: if I introduce a correct password, it works fine. If I introduce a bad password that must be rejected by pam_cracklib (for example, a password with only lower case letters), it works fine (rejects the password without problem).

But when I introduce a password that is valid for cracklib but not for pwcheck (a password with upper case, lower case and numbers of 7 characters length), it rejects the password, but this error is shown:

Bad password: too short    
passwd: Authentication token manipulation error

So, pam_pwcheck print its error message (Bad password: too short), but something bad happens with the PAM chain.

Do you know what is wrong in my configuration?

P.S. The "security" requirements are not mine at all, so please, avoid comments on it ;-).

Answer 1

Try restructuring your PAM chain like this for file, /etc/pam.d/common-password:

password required pam_pwcheck.so
password required pam_cracklib.so use_authtok minlen=10 retry=3 minclass=3
password required pam_pwcheck.so remember=5 use_authtok use_first_pass
password required pam_unix2.so nullok use_authtok use_first_pass

I found the above and modified it slightly from this Novell document titled: using pam_pwcheck and pam_cracklib at the same time.

Additionally I used these as resources:

• pam_pwcheck man page
• pam_cracklib man page
• pam man page

Answer 2

I finally get it working only inverting the order of the two first modules:

password  requisite  pam_pwcheck.so  nullok cracklib minlen=10 remember=5
password  requisite  pam_cracklib.so minclass=3 retry=3
password  required   pam_unix2.so    use_authtok nullok

Now, I'm facing another error, but I will ask it in another question.

Answer 3

For me, I was using a Fedora 25 systemd-nspawn container, and nothing I tried worked until I reinstalled passwd with sudo dnf reinstall passwd.