Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wanted to set a password restriction policy , like minlen , maxage , minage etc .

I know the way to do it system wide ,

Can we do it for a particular group of users . I mean only users under group of admin should compile with these restriction , and other users should compile these restrictions..

share|improve this question
slight correction .. – Amit Singh Jul 4 '13 at 16:52
other users should not compile these restrictions.. – Amit Singh Jul 4 '13 at 16:56

You say that you know how to enforce a password policy system-wide, but I'll reiterate what to do for anyone who doesn't. You can use a PAM module,, that checks to make sure a password meets certain criteria before allowing the password to be applied to an account. In Ubuntu, the package libpam-cracklib installs this module, and applies the following line to the top of /etc/pam.d/common-password, the file that deals with changing a user's password:

password    requisite  retry=3 minlen=8 difok=3

Various options can be passed to, and in this case a minimum length of 8 is specified with a requirement of 3 character changes from the old password. See for a detailed list of every option available.

To limit one policy for a certain group of users, it is possible to utilise the module, that only succeeds if a user matches various criteria. For example, to enforce a password policy like the one above, but leaving users in the 'sudo' group exempt, use:

password    [success=1 default=ignore] user ingroup sudo
password    requisite  retry=3 minlen=8 difok=3

This tells PAM to check if the user matches group 'sudo', then skip the next module if that succeeds. Otherwise, continue on with the next module, which enforces a password policy.

However, if using a PAM module with the option use_authtok like the default Ubuntu configuration with installed, this will not work quite right. Since depends on a module previously to have set the current user password and desired password, should the module succeed then passwd will error out with passwd: Authentication token manipulation error. The way I got around it was to use a second line:

password    [success=2 default=ignore] user ingroup sudo
password    requisite  retry=3 minlen=8 difok=3
password    [success=2 default=ignore] obscure use_authtok try_first_pass sha512
password    [success=1 default=ignore] obscure sha512

In this example, should the user be in group 'sudo', control skips 2 modules down to the final line which does not include use_authtok. Should it fail however, control passes to, then to the dependent

share|improve this answer
Great Help sir , I worked .. – Amit Singh Jul 18 '13 at 9:58
I have 1 more query , I want that whenever user run passwd command it should display some banner like minimum length required =8 etc.. – Amit Singh Jul 18 '13 at 14:01
For this you can use a module that simply echoes out a message. For example, to echo out the contents of a file that details what a good password is, use password optional file=/usr/share/doc/good-password.txt, putting that line before any others in common-password. – Xenopathic Jul 19 '13 at 10:37
Also, if the answer above worked for you, please don't forget to mark it as accepted – Xenopathic Jul 19 '13 at 10:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .