To rate a password without changing it, use the pwscore command. It reads a password from standard input and prints a score from 0 to 100 or a reason for refusal — by the same rules from pwquality.conf. So echo 'password' | pwscore answers with a refusal: the password is based on a dictionary word.
The check has an important boundary. The policy applies when an ordinary user changes a password with passwd. root and scripts using chpasswd bypass it: such a password prints a BAD PASSWORD warning but changes anyway. So a weak password handed out by an admin is not stopped by the policy (unless pwquality.conf has the line enforce_for_root) — it protects against weak passwords chosen by the users themselves.
You turned on pwquality with minlen = 12. An admin sets a short password with echo 'bob:123' | sudo chpasswd. What happens?
-
chpasswd is not interactive — it waits for no input. As root it changes the password at once, with only a warning.
-
root bypasses the policy:
echo $?afterchpasswdis 0, the password is changed. It prints theBAD PASSWORDwarning but does not stop.
pwquality applies when an ordinary user changes a password. root and scripts using chpasswd bypass it: the password changes, and only a BAD PASSWORD warning shows. So weak passwords handed out by an admin slip past the policy.
Now set the policy yourself. Eight characters is enough by default — too little for a server: a strong password starts with length and a mix of character classes. A class is a group of characters: lowercase letters, uppercase, digits, punctuation. Turn on the quality check and write into pwquality.conf a minimum of twelve characters and at least three classes, so that an ordinary user cannot set a short or single-class password, even to save themselves some effort.
Turn on the password check
Turn on the password quality check (pwquality) and set a policy: at least 12 characters and at least three character classes. The policy must apply when a user changes their own password.
Goals · 0 of 2
- Set the policy: 12 characters and three classes not done yet
- Make a simple password get rejected not done yet