pam_pwcheck(8)							 Reference Manual						    pam_pwcheck(8)

NAME

       pam_pwcheck - PAM module for password strength checking

DESCRIPTION

       The  pam_pwcheck is a PAM module for password strength checking. It makes additional checks upon password changes, but does not perform the
       change itself.  It only provides functionality for one PAM management group: password changing.

       This module works in the following manner: if enabled, it first calls the Cracklib routine to check the strength of the password; if  crack
       likes the password, the module does an additional set of strength checks. These checks are:

       Palindrome
	      Is the new password a palindrome of the old one?

       Case Change Only
	      Is the new password the old one with only a change of case?

       Similar
	      Is the new password too similar to old one?

       Simple Is the new password too short?

       Rotated
	      Is the new password a rotated version of the old password?

       Already used
	      Was the password used in the past?  Previously used passwords are to be found in /etc/security/opasswd.

OPTIONS

       The following options may be passed to the module:

       cracklib=<path to dictionaries>
	      Use  cracklib  library  for  password  checks.  This  parameter  also contains the path to the cracklib dictionaries. The default is
	      /usr/lib/cracklib_dict.

       debug  A lot of debug information is printed with syslog(3).

       maxlen=number
	      Number of significant characters in the password for crypt(3).  A value of zero suppresses this check. The default is 0.

       minlen=number
	      The minimum number of characters in an acceptable password.  A new password with fewer characters will be rejected. A value of  zero
	      suppresses this check. The default is 5.

       no_obscure_checks
	      No  additional checks will be performed before a new password is accepted. Since the checks performed are fairly simple, their usage
	      is recommended.

       not_set_pass
	      If this option is given, pam_pwcheck will not make the new password available for other modules.

       nullok Normally the account is disabled if no password is set or if the length of the password is zero. With this option you can allow  the
	      user to change his password for such accounts. This option does not overwrite a hardcoded default by the calling process.

       tries=number
	      Maximum number of attempts to change a password if the new ones are rejected because they are too easy.

       use_authtok
	      Set  the new password to the one provided by the previously stacked password module. If this option is not set, pam_pwcheck will ask
	      the user for the new password.

       use_first_pass
	      By default pam_pwcheck tries to get the authentication token from a previous module.  If no token is available, the  user  is  asked
	      for  the	old  password.	 With  this  option, pam_pwcheck aborts with an error if no authentication token from a previous module is
	      available.

       remember=XX
	      Remember the last XX passwords and do not allow the user to reuse any of these for the next XX password  changes.  XX  is  a  number
	      between 1 and 400.

       enforce_for_root
	      If  this	option	is set, most of the password check rules are enforced for root, too.  Never use this option if you don't know what
	      you are doing, since it could be as result that root is no longer allowed to login at all.

FILES

       /etc/security/opasswd

SEE ALSO

       passwd(1), pam.conf(8), pam.d(8), pam(8), rpasswd(1), rpasswdd(8), rpc.yppasswdd(8), yppasswd(1)

pam_pwcheck							  September 2008						    pam_pwcheck(8)