Modern Linux systems running PAM 1.5.3 already include robust password complexity and history features via pam_pwquality.so. Downgrading to version 1.1.4 is unnecessary, dangerous, and removes critical security patches. To enforce strong passwords, you only need to configure the existing modules in /etc/pam.d/system-auth or /etc/pam.d/password-auth.
The Danger of Downgrading PAM
Linux distributions package PAM with significant security updates between major versions. Moving from a modern release like 1.5.3 back to an older legacy version such as 1.1.4 exposes your system to known vulnerabilities that have been patched for years. This action breaks compatibility with current authentication services, potentially locking out administrators or causing login failures across the entire system.
Furthermore, older PAM versions lack support for modern cryptographic standards required by contemporary applications. They do not handle Unicode characters in passwords correctly, leading to inconsistent validation results. The risk of introducing a downgrade far outweighs any perceived benefit, as the functionality you seek is already present in the current library.
Configuring Password Complexity with pam_pwquality
The standard method for enforcing password policies on RHEL, CentOS, Fedora, and compatible distributions is the pam_pwquality.so module. This module replaces the deprecated pam_cracklib.so and provides comprehensive checks for password strength, history, and reuse.
To implement these rules, edit the appropriate PAM configuration file. On most systems, this is /etc/pam.d/system-auth for local users and /etc/pam.d/password-auth for remote access. Locate the line containing pam_pwquality.so or pam_cracklib.so. If it is missing, add the following line after the pam_unix.so entry:
password requisite pam_pwquality.so retry=3 minlen=12 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 enforce_for_rootThis configuration enforces several critical security measures simultaneously. The minlen=12 parameter sets the minimum password length to twelve characters, which is the current industry best practice. The ucredit, lcredit, dcredit, and ocredit parameters require at least one uppercase letter, one lowercase letter, one digit, and one special character, respectively.
The retry=3 flag allows users three attempts before the system rejects the input entirely. The enforce_for_root option ensures that even the root user must adhere to these complexity rules, preventing weak administrative credentials. You can adjust these values based on your specific organizational policy, but reducing them below these thresholds significantly weakens security.
Enforcing Password History
Password history prevents users from reusing recent passwords, mitigating the risk of brute-force attacks on old credentials. This feature is controlled by the pam_pwhistory.so module. Similar to complexity settings, this module is included in modern PAM distributions and does not require a version downgrade.
Add the following line to your PAM configuration files, typically placing it before the pam_unix.so password line:
password sufficient pam_pwhistory.so remember=5 use_authtokThe remember=5 directive instructs the system to track the last five passwords. Users will be unable to set any of those previous passwords as their new credential. The use_authtok flag ensures that the module uses the authentication token provided by the preceding module, ensuring consistency in validation.
If you are managing a large enterprise environment, consider integrating with LDAP or Active Directory for centralized password policies. Local PAM configurations are excellent for standalone servers but become difficult to maintain at scale. For detailed guidance on securing server access broadly, see our guide on Securing an Ubuntu Server for Development Purposes.
Verifying Your Configuration
After modifying the PAM files, test the changes immediately using a non-root user account. Attempt to set a weak password to verify that the complexity checks trigger correctly. Then, try setting a password that matches one of the previous five entries to confirm the history enforcement works.
Check the system logs for any authentication errors. On systemd-based systems, use journalctl -f while attempting a password change to view real-time PAM messages. Look for lines indicating pam_pwquality rejection reasons, such as "BAD PASSWORD" or "too short".
Ensure that your backup mechanisms are intact before making broad changes. If you accidentally lock yourself out due to a misconfiguration, you may need to boot into rescue mode to restore the original PAM files. Always keep a terminal session open with root privileges when editing PAM configurations to avoid accidental lockouts.
Related Security Measures
Password complexity is just one layer of defense. Consider restricting SSH access to specific groups to limit exposure. Our article on Restricting SSH Access for wheel Group Users in Red Hat 9 using PAM's pam_access.so - Not Denying Access explains how to further harden your authentication pathways.
Additionally, ensure that your system is not vulnerable to network-level attacks that could bypass local password policies. Tools like iptables can help block malicious MAC addresses during active attacks, as discussed in Block MAC Address with Iptables During Attack.
Frequently Asked Questions
Can I still use pam_cracklib instead of pam_pwquality?
No, pam_cracklib.so is deprecated and removed in modern PAM versions. Using it will cause authentication failures because the module no longer exists in the library path. You must migrate to pam_pwquality.so for all password quality checks.
Why does my root user ignore password complexity rules?
By default, many PAM configurations exclude the root user from complexity checks for administrative convenience. Add the enforce_for_root option to your pam_pwquality.so line to override this behavior and apply rules universally.
How do I reset the password history count?
There is no built-in command to clear password history for individual users. The history is stored in /etc/security/opasswd. You can delete this file to reset history for all users, but this should be done cautiously as it removes protection against password reuse for everyone.
Does PAM 1.5.3 support Unicode passwords?
Yes, modern PAM versions fully support Unicode characters in passwords. Older versions like 1.1.4 often failed to validate multi-byte characters correctly, leading to login issues for users with international names or symbols.
What happens if I disable password aging?
Disabling password aging means users never have to change their passwords. While convenient, this increases the window of opportunity for attackers who compromise a credential. It is recommended to keep aging enabled alongside complexity requirements for a balanced security posture.