Checking a password and a login is the job of PAM — a set of pluggable modules.
passwd, su, sshd, login do not check the password themselves: each of them asks PAM. PAM's settings live in the /etc/pam.d/ directory. The common-auth file handles login — checking the password you type; common-password handles changing a password. Inside each file is a list of modules; the system walks it top to bottom, and each module decides its own piece: one matches the password against the stored one, another checks its quality, a third counts misses.
You usually do not write a module line in common-* by hand. The pam-auth-update command assembles the module set: you enable a ready-made setting with it, and it edits the shared files for you without breaking the order of lines.
Key points
- Login and password changes for every program are checked by PAM — a set of modules.
-
common-authchecks the password at login,common-passwordhandles password changes; modules run top to bottom. -
Ready-made module sets are turned on with
pam-auth-update: it editscommon-*itself and keeps the line order.