I'm implementing a security policy that will force the users to introduce stricter passwords when they change their own:
/etc/pam.d/passwd configuration file is:
#%PAM-1.0 auth include common-auth account include common-account password include common-password session include common-session
So, I made changes in this file
common-password file comes with this two lines:
password requisite pam_pwcheck.so nullok cracklib password required pam_unix2.so use_authtok nullok
I need to add several options to the pam_pwcheck (no problem with that) and another PAM module (pam_cracklib) to make the passwords stronger. Next, it is my final
/etc/pam.d/common-password file, included from
password requisite pam_cracklib.so minclass=3 retry=3 password requisite pam_pwcheck.so nullok cracklib minlen=10 remember=5 password required pam_unix2.so use_authtok nullok
My problem occurs when I have both PAM modules configured: if I introduce a correct password, it works fine. If I introduce a bad password that must be rejected by
pam_cracklib (for example, a password with only lower case letters), it works fine (rejects the password without problem).
But when I introduce a password that is valid for
cracklib but not for
pwcheck (a password with upper case, lower case and numbers of 7 characters length), it rejects the password, but this error is shown:
Bad password: too short passwd: Authentication token manipulation error
pam_pwcheck print its error message (
Bad password: too short), but something bad happens with the PAM chain.
Do you know what is wrong in my configuration?
P.S. The "security" requirements are not mine at all, so please, avoid comments on it ;-).