Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wanted to set a password restriction policy , like minlen , maxage , minage etc .

I know the way to do it system wide ,

Can we do it for a particular group of users . I mean only users under group of admin should compile with these restriction , and other users should compile these restrictions..

share|improve this question
slight correction .. – Amit Singh Jul 4 '13 at 16:52
other users should not compile these restrictions.. – Amit Singh Jul 4 '13 at 16:56

You say that you know how to enforce a password policy system-wide, but I'll reiterate what to do for anyone who doesn't. You can use a PAM module,, that checks to make sure a password meets certain criteria before allowing the password to be applied to an account. In Ubuntu, the package libpam-cracklib installs this module, and applies the following line to the top of /etc/pam.d/common-password, the file that deals with changing a user's password:

password    requisite  retry=3 minlen=8 difok=3

Various options can be passed to, and in this case a minimum length of 8 is specified with a requirement of 3 character changes from the old password. See for a detailed list of every option available.

To limit one policy for a certain group of users, it is possible to utilise the module, that only succeeds if a user matches various criteria. For example, to enforce a password policy like the one above, but leaving users in the 'sudo' group exempt, use:

password    [success=1 default=ignore] user ingroup sudo
password    requisite  retry=3 minlen=8 difok=3

This tells PAM to check if the user matches group 'sudo', then skip the next module if that succeeds. Otherwise, continue on with the next module, which enforces a password policy.

However, if using a PAM module with the option use_authtok like the default Ubuntu configuration with installed, this will not work quite right. Since depends on a module previously to have set the current user password and desired password, should the module succeed then passwd will error out with passwd: Authentication token manipulation error. The way I got around it was to use a second line:

password    [success=2 default=ignore] user ingroup sudo
password    requisite  retry=3 minlen=8 difok=3
password    [success=2 default=ignore] obscure use_authtok try_first_pass sha512
password    [success=1 default=ignore] obscure sha512

In this example, should the user be in group 'sudo', control skips 2 modules down to the final line which does not include use_authtok. Should it fail however, control passes to, then to the dependent

share|improve this answer
Great Help sir , I worked .. – Amit Singh Jul 18 '13 at 9:58
I have 1 more query , I want that whenever user run passwd command it should display some banner like minimum length required =8 etc.. – Amit Singh Jul 18 '13 at 14:01
For this you can use a module that simply echoes out a message. For example, to echo out the contents of a file that details what a good password is, use password optional file=/usr/share/doc/good-password.txt, putting that line before any others in common-password. – Xenopathic Jul 19 '13 at 10:37
Also, if the answer above worked for you, please don't forget to mark it as accepted – Xenopathic Jul 19 '13 at 10:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.