6

I have a machine with CentOS and I want to enable a simple password for the root user. Something like 7 characters with 2 numbers or so...

But I'm getting this error:

BAD PASSWORD: it is based on a (reversed) dictionary word

Anyone has an idea how to enable this kind of passwords?

2
  • 1
    Is the server going to be connected to a network or even the internet?
    – Bobby
    Jul 4, 2012 at 11:14
  • I don't think you should use simple passwords but this as far as I know this message is just a warning, you can continue confirm the password and it will be set.
    – Matteo
    Jul 4, 2012 at 13:52

3 Answers 3

0

Check this out:

You can use PAM (Pluggable Authentication Modules) to configure a simple password strength checking and password changing policies for all users. /etc/pam.d/system-auth provides important settings for system authentication.

pam_cracklib - It is a simple password strength checking module for PAM. In addition to checking regular passwords, it offers support for passphrases and can provide randomly generated ones. pam_passwdqc - This module provides functionality for only one PAM management group: password changing. In terms of the module-type parameter, this is the "password" feature. pam_chauthtok() - Service function may ask the user for a new password, and verify that it meets certain minimum standards. If the chosen password is unsatisfactory, the service function returns PAM_AUTHTOK_ERR.

Setup Strength Checking For Passwords

The default pam_cracklib PAM module provides strength-checking for passwords. It rejects the password if any one of the following conditions found:

Palindrome - Is the new password a palindrome of the old one? Case Change Only - Is the new password the the old one with only a change of case? Similar - Is the new password too much like the old one? Simple - Is the new password too small? Rotated - Is the new password a rotated version of the old password? Already used - Was the password used in the past? Previously used passwords are to be found in /etc/security/opasswd.

How To Use pam_passwdqc - Password Quality-control PAM Module

Edit the file /etc/pam.d/system-auth: cp /etc/pam.d/system-auth /root/backup/system-auth vi /etc/pam.d/system-auth

Find the line:

password requisite pam_cracklib.so try_first_pass retry=3 and replace it with the following line:

password requisite pam_passwdqc.so min=disabled,disabled,12,8,7 retry=3 Where,

min=N0,N1,N2,N3,N4 - min=disabled,disabled,12,8,7 is the password policy. Each filed (N0,N1..N4) is used for different purpose. The keyword disabled can be used to disallow passwords of a given kind regardless of their length. Each subsequent number is required to be no larger than the preceding one. N0 is used for passwords consisting of characters from one character class only. The character classes are - digits, lower-case letters, upper-case letters, and other characters. N1 is used for passwords consisting of characters from two character classes which do not meet the requirements for a passphrase. N2 is used for passphrases. A passphrase must consist of sufficient words (see the passphrase option below). N3 and N4 are used for passwords consisting of characters from three and four character classes, respectively. When calculating the number of character classes, upper-case letters used as the first character and digits used as the last character of a password are not counted. In addition to being sufficiently long, passwords are required to contain enough different characters for the character classes and the minimum length they have been checked against. retry=3 - The number of times the module will ask for a new password if the user fails to provide a sufficiently strong password and enter it twice the first time. See the help file /usr/share/doc/pam_passwdqc-1.0.2/README and the man page pam_passwdqc for detailed configuration options.

Source: http://www.cyberciti.biz/faq/rhel-fedora-centos-linux-password-quality-control/

17
  1. vi /etc/pam.d/system-auth as root.

  2. Look for the following two lines:

    password    requisite     pam_cracklib.so try_first_pass retry=3
    password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
    
  3. Comment out the first of the two lines:

    #password    requisite     pam_cracklib.so try_first_pass retry=3
    
  4. Remove use_authtok on the second line. Otherwise you’ll get “passwd: Authentication information cannot be recovered” error.

    password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
    
  5. That’s it. Try changing your password again.

4
  • works on aws centos:-) Apr 17, 2019 at 12:23
  • 4
    For Ubuntu (since the error message from google sends me here), same instructions but the file is /etc/pam.d/common-password
    – rogerdpack
    Apr 1, 2020 at 4:03
  • Did you check off my answer? I was working with Debian and CentOS server, I also like Ubuntu expected like yum or apt something like Roger Wilco #rogerdpack
    – hram908
    Apr 2, 2020 at 20:34
  • Works perfectly fine. So in love of my root/root account ! :)
    – Zofren
    Dec 10, 2020 at 15:49
1
  1. vim /etc/pam.d/system-auth

comment the line:

#password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=

and delete "use_authtok" from the line:

password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .