Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a machine with CentOS and I want to enable a simple password for the root user. Something like 7 characters with 2 numbers or so...

But I'm getting this error:

BAD PASSWORD: it is based on a (reversed) dictionary word

Anyone has an idea how to enable this kind of passwords?

share|improve this question
Is the server going to be connected to a network or even the internet? – Bobby Jul 4 '12 at 11:14
I don't think you should use simple passwords but this as far as I know this message is just a warning, you can continue confirm the password and it will be set. – Matteo Jul 4 '12 at 13:52
up vote 0 down vote accepted

Check this out:

You can use PAM (Pluggable Authentication Modules) to configure a simple password strength checking and password changing policies for all users. /etc/pam.d/system-auth provides important settings for system authentication.

pam_cracklib - It is a simple password strength checking module for PAM. In addition to checking regular passwords, it offers support for passphrases and can provide randomly generated ones. pam_passwdqc - This module provides functionality for only one PAM management group: password changing. In terms of the module-type parameter, this is the "password" feature. pam_chauthtok() - Service function may ask the user for a new password, and verify that it meets certain minimum standards. If the chosen password is unsatisfactory, the service function returns PAM_AUTHTOK_ERR.

Setup Strength Checking For Passwords

The default pam_cracklib PAM module provides strength-checking for passwords. It rejects the password if any one of the following conditions found:

Palindrome - Is the new password a palindrome of the old one? Case Change Only - Is the new password the the old one with only a change of case? Similar - Is the new password too much like the old one? Simple - Is the new password too small? Rotated - Is the new password a rotated version of the old password? Already used - Was the password used in the past? Previously used passwords are to be found in /etc/security/opasswd.

How To Use pam_passwdqc - Password Quality-control PAM Module

Edit the file /etc/pam.d/system-auth: cp /etc/pam.d/system-auth /root/backup/system-auth vi /etc/pam.d/system-auth

Find the line:

password requisite try_first_pass retry=3 and replace it with the following line:

password requisite min=disabled,disabled,12,8,7 retry=3 Where,

min=N0,N1,N2,N3,N4 - min=disabled,disabled,12,8,7 is the password policy. Each filed (N0,N1..N4) is used for different purpose. The keyword disabled can be used to disallow passwords of a given kind regardless of their length. Each subsequent number is required to be no larger than the preceding one. N0 is used for passwords consisting of characters from one character class only. The character classes are - digits, lower-case letters, upper-case letters, and other characters. N1 is used for passwords consisting of characters from two character classes which do not meet the requirements for a passphrase. N2 is used for passphrases. A passphrase must consist of sufficient words (see the passphrase option below). N3 and N4 are used for passwords consisting of characters from three and four character classes, respectively. When calculating the number of character classes, upper-case letters used as the first character and digits used as the last character of a password are not counted. In addition to being sufficiently long, passwords are required to contain enough different characters for the character classes and the minimum length they have been checked against. retry=3 - The number of times the module will ask for a new password if the user fails to provide a sufficiently strong password and enter it twice the first time. See the help file /usr/share/doc/pam_passwdqc-1.0.2/README and the man page pam_passwdqc for detailed configuration options.


share|improve this answer
  1. vi /etc/pam.d/system-auth as root.

  2. Look for the following two lines:

    password    requisite try_first_pass retry=3
    password    sufficient md5 shadow nullok try_first_pass use_authtok
  3. Comment out the first of the two lines:

    #password    requisite try_first_pass retry=3
  4. Remove use_authtok on the second line. Otherwise you’ll get “passwd: Authentication information cannot be recovered” error.

    password    sufficient md5 shadow nullok try_first_pass
  5. That’s it. Try changing your password again.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.