BiteSizedChunks.comLearn one small thing at a time.
Course contentsShow
← Linux
Lesson 822 of 1,8198. User Management and Pluggable Authentication ModulesFree lesson

Integrating Password Quality Enforcement

You will apply complexity and strength policies using the pam_pwquality module.

In this lesson, you will learn how to automate password complexity enforcement across your system using the pam_pwquality module.

Enforcing Password Strength with PAM

Even with robust hashing algorithms, a system remains vulnerable if users choose weak, dictionary-based passwords. The pam_pwquality module acts as a gatekeeper during password changes, performing real-time entropy checks before allowing a password to be saved in the /etc/shadow file.

Because we have previously mastered the architecture of Pluggable Authentication Modules (PAM) and the four management groups, we know that password enforcement belongs in the password stack.

Configuring the Enforcement Policy

To integrate this, you typically modify /etc/pam.d/common-password (or the specific service file, such as system-auth). You insert the pam_pwquality.so module at the top of the stack.

# Add this line to /etc/pam.d/common-password
password requisite pam_pwquality.so retry=3 minlen=12 difok=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1

Here is what these parameters enforce:

  • retry=3: Allows the user three attempts to provide a password that meets the criteria before failing.
  • minlen=12: Sets the minimum total length of the password.
  • difok=3: Requires that at least 3 characters must be different from the previous password.
  • ucredit, lcredit, dcredit, ocredit: These set the requirements for uppercase, lowercase, digits, and special characters. Setting them to -1 forces at least one of each type.

Integration Logic

By using the requisite control flag, we ensure that if the password fails the pam_pwquality check, the module immediately returns an error. This prevents the user from proceeding to the next module in the stack (like pam_unix), effectively blocking the update if the strength criteria are not met. This prevents poor password choices from ever reaching the hashing stage of the authentication lifecycle.

Once this is configured, any utility that calls the PAM password stack—such as passwd or chpasswd—will transparently begin enforcing these complexity standards, ensuring consistent security posture across all user accounts.

Key Takeaway: Integrating pam_pwquality within the password stack provides an automated, mandatory enforcement layer that prevents weak passwords from being accepted by the system.