Requiring Strong Passwords

Who decides a password is too weak?

Something has to be switched on for anything to be checked at all. If it is missing, "password" is an acceptable password.

Look first

sudo nano /etc/pam.d/common-password

Ignore every line starting with #, those are just notes. You are looking for a line containing the word pam_pwquality.

On this image there is not one. What you will see is something like this:

password  [success=2 default=ignore]  pam_unix.so obscure yescrypt
password  sufficient                  pam_sss.so
password  requisite                   pam_deny.so
password  required                    pam_permit.so
password  optional                    pam_gnome_keyring.so

pam_unix stores the password. Nothing above it checks whether the password is any good. That missing line is the finding, and it is worth points.

Leave with Ctrl+X without changing anything. You do not add the line by hand.

Then fix it, with two commands

sudo apt install -y libpam-pwquality
sudo pam-auth-update --enable pwquality

Run both, in that order. The first command will probably tell you it is already installed and do nothing. That is expected. The second one is what puts the line back, and it is the part people miss.

Check it worked

sudo nano /etc/pam.d/common-password

A new line has appeared at the top of the block:

password  requisite  pam_pwquality.so retry=3

That is all it says, and that is normal. retry=3 just means you get three attempts at a new password. The actual requirements are not in this file, so do not go looking for a length setting here.

If the line still is not there, check the machine has internet, because apt has to be able to download.

💡 You can do the second step from a menu instead. Running sudo pam-auth-update with nothing after it opens a list of options. Move to Password quality checking with the arrow keys, press Space to tick it, then Tab to Ok and Enter. Same result, and it shows you everything else that is switched on while you are there.

Where the requirements actually live

They are in a separate file, which is much easier to read:

sudo nano /etc/security/pwquality.conf

Every setting in there starts switched off, with a # in front of it and a comment explaining what it does:

# minlen = 8
# dcredit = 0
# ucredit = 0

To turn one on, delete the # and set the number you want, exactly like you did in the SSH settings file:

The minus sign is the part people get wrong. A negative number means require at least this many. A positive number means something else entirely, so ucredit = 1 does not require a capital letter.

Save with Ctrl+O, Enter, then Ctrl+X.

The mistake that breaks everything

Be careful in this file. If you see the words use_authtok on a line and there is no pam_pwquality line above it, then every password change on the machine fails with a message about an "authentication token manipulation error".

It sounds like the system is broken. It is one line in the wrong order, and while it lasts you cannot fix any of the blank-password findings, because you cannot set a password at all.

If that happens to you, this puts the file back to a working state:

sudo pam-auth-update

Try it yourself

Work it in that order:

sudo nano /etc/pam.d/common-password      # 1. no pam_pwquality line. That is the finding
sudo apt install -y libpam-pwquality      # 2. may well say "already the newest version"
sudo pam-auth-update --enable pwquality   # 3. this is what puts the line back
sudo nano /etc/pam.d/common-password      # 4. the line is there now
sudo nano /etc/security/pwquality.conf    # 5. switch the requirements on

Then try setting a test account's password to password and see whether it is refused. If it is accepted, nothing is checking.