I'm implementing a security policy that will force the users to introduce stricter passwords when they change their own:

The /etc/pam.d/passwd configuration file is:

auth     include    common-auth
account  include    common-account
password include    common-password
session  include    common-session

So, I made changes in this file /etc/pam.d/common-password.

The default common-password file comes with this two lines:

password    requisite   pam_pwcheck.so  nullok cracklib
password    required    pam_unix2.so    use_authtok nullok

I need to add several options to the pam_pwcheck (no problem with that) and another PAM module (pam_cracklib) to make the passwords stronger. Next, it is my final /etc/pam.d/common-password file, included from passwd:

password  requisite  pam_cracklib.so minclass=3 retry=3
password  requisite  pam_pwcheck.so  nullok cracklib minlen=10 remember=5
password  required   pam_unix2.so    use_authtok nullok

My problem occurs when I have both PAM modules configured: if I introduce a correct password, it works fine. If I introduce a bad password that must be rejected by pam_cracklib (for example, a password with only lower case letters), it works fine (rejects the password without problem).

But when I introduce a password that is valid for cracklib but not for pwcheck (a password with upper case, lower case and numbers of 7 characters length), it rejects the password, but this error is shown:

Bad password: too short    
passwd: Authentication token manipulation error

So, pam_pwcheck print its error message (Bad password: too short), but something bad happens with the PAM chain.

Do you know what is wrong in my configuration?

P.S. The "security" requirements are not mine at all, so please, avoid comments on it ;-).

  • 1
    How do you configure "both" modules? Do you have another policy that includes those two mentioned? Please expand your question with details about that setup.
    – Nils
    Commented Jun 20, 2013 at 15:14
  • I wrote on my question the configuration before and after the change. This configuration is on /etc/pam.d/common-password, and it is loaded by passwd. I edit the question and copy the passwd config file Commented Jun 20, 2013 at 15:34

3 Answers 3


Try restructuring your PAM chain like this for file, /etc/pam.d/common-password:

password required pam_pwcheck.so
password required pam_cracklib.so use_authtok minlen=10 retry=3 minclass=3
password required pam_pwcheck.so remember=5 use_authtok use_first_pass
password required pam_unix2.so nullok use_authtok use_first_pass

I found the above and modified it slightly from this Novell document titled: using pam_pwcheck and pam_cracklib at the same time.

Additionally I used these as resources:

  • I already found and tested this configuration. With that, I'm not able to change the password from a normal user, when I execute passwd as normal user I'm not prompted for my current password and this error is shown: Changing password for test. passwd: Authentication information cannot be recovered Commented Jun 21, 2013 at 8:23

I finally get it working only inverting the order of the two first modules:

password  requisite  pam_pwcheck.so  nullok cracklib minlen=10 remember=5
password  requisite  pam_cracklib.so minclass=3 retry=3
password  required   pam_unix2.so    use_authtok nullok

Now, I'm facing another error, but I will ask it in another question.


For me, I was using a Fedora 25 systemd-nspawn container, and nothing I tried worked until I reinstalled passwd with sudo dnf reinstall passwd.

  • 1
    I would expect this is due to SELinux. I would expect reinstalling passwd from inside the container to clear the selinux label on /sbin/passwd, however you might encounter other problems later. See unix.stackexchange.com/questions/308687/…
    – sourcejedi
    Commented Jan 14, 2017 at 17:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .