Home Command line utilities How To Force Users To Use Strong Passwords In Debian, Ubuntu
Force Users To Use Strong Passwords In Debian, Ubuntu

How To Force Users To Use Strong Passwords In Debian, Ubuntu

By sk

A strong password must be comprised of at least 14 characters, including at least one special character, one numerical character, one uppercase and lower case letter. More importantly, passwords shouldn't be easily predictable and shouldn't be based on dictionary words. Some non-techie people however will not understand or don't care about the security. They will keep using easily predictable passwords like pass123, welcome123, [email protected] etc., that can be easily broken in few attempts. Also, they won't change the passwords for ages. As a System administrator, it is your job to enforce a strong password policy in order to protect the systems from dictionary-based and brute-force attacks. This brief tutorial will walk you through how to force users to use strong passwords in DEB based distributions like Debian, Ubuntu, Linux Mint etc., using Pluggable Authentication Modules (PAM).

I have tested this guide in Ubuntu 16.04 LTS server edition. Although, the instructions posted here are same for Debian, and other Debian and Ubuntu based distributions such as Linux Mint, Elementary OS etc.

Force Users To Use Strong Passwords In Debian, Ubuntu, Linux Mint

PAM is installed by default in DEB based systems. However, you need to install an additional module called libpam-cracklib. To do so, run the following command from Terminal:

$ sudo apt-get install libpam-cracklib

In DEB based systems, the password policies are defined in /etc/pam.d/common-password file. Before making any changes, backup this file.

$ sudo cp /etc/pam.d/common-password /home/sk/

Now, edit /etc/pam.d/common-password file:

$ sudo nano /etc/pam.d/common-password

Find the following line and edit or change it as shown below.

password required pam_cracklib.so try_first_pass retry=3 minlen=12 lcredit=1 ucredit=1 dcredit=2 ocredit=1 difok=2 reject_username


Let us break down this line and see what does each option do.

  • retry=N - Maximum number of retries to change password. N indicates the number. The default for this parameter is 1.
  • minlen=N - The minimum acceptable size for the new password (plus one if credits are not disabled which is the default). In addition to the number of characters in the new password, credit (of +1 in length) is given for each different kind of character (other, upper, lower and digit). The default value is 9.
  • lcredit=N - Define the maximum credit for containing lowercase letters in the password. Default value is 1.
  • ucredit=N - Define the maximum number for containing uppercase letters in the password. Default value is 1.
  • dcredit=N - Define the maximum credit for containing digits in the password. Default value is 1.
  • ocredit=N - Define the maximum credit for containing other characters in the password. Default value is 1.
  • difok=N - Define number of characters that must be different from the previous password.
  • reject_username - Restrict the users to use their name as password.

Hope you got a basic idea about the above parameters.

As defined in the above file, the users can now use password with a password complexity score of 12. 1 'credit' will be given to 1 lowercase letter, 1 credit for 1 uppercase letter, 1 credit for at least 2 digits, and 1 credit for 1 other character.

However, you can disable the credits by assigning negative values, and force the user to use combination of different characters with a minimum length.

Check the following example.

password required pam_cracklib.so minlen=8 lcredit=-1 ucredit=-1 dcredit=-2 ocredit=-1 difok=2 reject_username

As defined above, the users must use a password complexity score of 8 characters, including 1 lowercase letter, 1 uppercase letter, 2 digits, and 1 other character.

Please note that these restrictions are applied for the normal users only, but not for root user. Root user is free to use any type of password.

Check or verify the password complexity

Once you defined the password policy, check whether it's working or not.

Let us a assign simple password that doesn't meet the password policy and see what happens.

To change or assign passwd, run:

$ passwd

Sample output:

Changing password for sk.
(current) UNIX password: 
New password: 
BAD PASSWORD: it is WAY too short
New password: 
BAD PASSWORD: it does not contain enough DIFFERENT characters
New password: 
BAD PASSWORD: it is based on a dictionary word
passwd: Have exhausted maximum number of retries for service
passwd: password unchanged


As you see in the above output, If the password doesn't meet the requirements, the user can't set the password.

Let us try a password that meets the actual password policy (including at least 1 lowercase, 1 upper case, 2 digits, 1 other character).


As you see in the above screenshot, a secure password has been set for the user "sk".

That's all for now. We have successfully enforced the password policies using PAM. For more details, check man pages.

$ man pam_cracklib

Don't forget to check our detailed guide about implementing password policies in Linux.

Want to know how to generate a strong password? Check the following article.

Thanks for stopping by!

Help us to help you:

Have a Good day!!

You May Also Like


Michael T November 18, 2019 - 10:02 am

Why are you talking about ‘maximum complexity’ when talking bout minlen. Don’t you mean ‘*minimum complexity?’

sk November 18, 2019 - 12:04 pm

Nice catch. Thanks for pointing out. Corrected it now.


Leave a Comment

* By using this form you agree with the storage and handling of your data by this website.

This site uses Akismet to reduce spam. Learn how your comment data is processed.

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Accept Read More