Is there a way I can get information on the password for a particular user like what is the minimum length and minalpha and etc.?

In AIX we have a command called lsuser:

lsuser -a minlen username 

That command will return the minimum length of a user's password. Is there an equivalent command in Linux?

I need this to find the users who have weak passwords, since even though I apply the restriction from pam, a user can change whatever password he want as root user.

I don't have to apply the restriction for root.

Thanks Amit

  • 1
    Are you asking about how to find weak passwords or prevent them? – ethrbunny Nov 14 '13 at 13:18
  • This sounds like you are administering a system for many users but questions about IT networks are off topic here. I recommend you flag this post for moderator attention and ask them to migrate to either Server Fault or Unix & Linux. This question will be on topic on both sites and you will also have a better chance of getting answers since that is where the professional *nix sysadmins hang out. – terdon Nov 14 '13 at 13:40
  • 2
    According to the documentation of the shadow file the passwords are only stored as hashes. There is no way to know the length of the once saved passwords. You'd be better off enforcing a rule when users assign themselves new passwords (or get assigned). – Bobby Nov 14 '13 at 13:51
  • Those attributes can be considered password policy and are not retroactive. They are not derived from the password. – Brian Nov 14 '13 at 14:40

To my knowledge (20+) years, there is no method to do this in any variant of Linux. More importantly this just sounds like a bad idea from a security standpoint.

No meta information about the passwords should be kept around, since in the wrong hands, could completely reduce the cracking problem space from impossible to easy.

Think about it, you're a cracker that has either gained access to a Linux system, or has retrieved the /etc/shadow file, and you're now attempting to use a rainbow table to gain access to several of the accounts in this file.

Sure would be handy info to tell my algorithm to skip any entries in my table that don't match the minimum length or don't contain a minimum number of alpha characters, with respect to the hashed password we're attempting to identify.

Incidentally, most of the methods I've seen employed at Fortune 500 companies that I've worked at would include using a cracking tool such as John the Ripper, or something similar, to attempt to break into the accounts as part of any auditing activities.

| improve this answer | |

I don't think there is a command that pulls things together as on AIX.

How to enforce password complexity on Linux
see /etc/login.defs

My machine (Fedora release 19) has

# PASS_MIN_LEN    Minimum acceptable password length.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.