2

I would like to prevent the use of last passwords and keeping password complexity.

But if I use pam_pwquality.so and pam_pwhistory.so at the same time, it doesn't work properly.

For example, I set a minimum length of 8 and disable the last two passwords in the system-auth file.

password    requisite     pam_pwquality.so local_users_only retry=3 minlen=8
password    requisite     pam_pwhistory.so remember=2 retry=3

If I enter the last password that meets the complexity, pwhistory blocks me, but after that, it is possible to change the password without complexity. -> Does the first module become invalid if the check passes to the second module?

The situation is similar when pwquality and pwhistory are reversed.

password    requisite     pam_pwhistory.so remember=2 retry=3
password    requisite     pam_pwquality.so local_users_only retry=3 minlen=8

It works as follows.

$passwd

Enter the last password -> failed by pwhistory module

Enter short password -> failed by pwquality module

Enter the last password -> success regardless of pwhistory module

Can't I check the complexity and the last password condition at the same time?

Improve this question
1
  • hmm, maybe set retry=1 so that the password change attempt stops when anything fails? it looks like PAM is getting confused with the multiple attempts, I guess Commented Sep 8, 2022 at 2:48

1 Answer 1

Reset to default
1

I think you need to use the use_authtok parameter when stacking pwhistory with other password changing modules (like pwquality, which changes the original chosen password):

password    requisite     pam_pwquality.so local_users_only retry=3 minlen=8
password    requisite     pam_pwhistory.so remember=2 retry=3 use_authtok

You can look at the man-page for the pwhistory module using

man pam_pwhistory

Excerpt from the man-page:

use_authtok

When password changing enforce the module to use the new password provided by a previously stacked password module (this is used in the example of the stacking of the pam_cracklib module documented below).

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.