I'm on Red Hat 6.6 now, trying to enforce password policy for root user. My /etc/pam.d/system-auth file contains following lines:

# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_fprintd.so
auth        required      pam_tally2.so deny=5 unlock_time=900
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_tally2.so
account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type= ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 maxrepeat=3 \
                                          reject_username enforce_for_root
password    sufficient    /lib64/security/pam_unix.so sha512 shadow nullok remember=5 use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

It works for passwd command, when I'm trying to change password to simple (like '123'), it is not accepting password.

But when I'm trying to change it through GUI (gnome2, system-config-users utility) it only throws warnings about bad password complexity and I can apply weak password anyway.

How can I deny setting weak passwords through GUI?


I have downloaded source code of system-config-users and it seems that there's no such possibility(it always suggest to continue even if pam fails)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.