PAM: password policy and lockout

Not running Starting usually ~20 s

Step 7 of 8 · lab · 30 min

A password can be anything

Interns change their own passwords and the system accepts any of them, while guessing a password can go on forever. Introduce a password policy and a lockout after failed attempts without losing your own key login and sudo.

Situation

Interns are joining the server team. Their accounts are created with a temporary password, and after that everyone changes it themselves with passwd. The intern intern set the password qwerty12 — the system did not object. Guessing a password can go on forever too: wrong passwords in su have no consequences.

You are the administrator: you log in with a key (ssh localhost) and work through sudo. The intern's account is handy for checking the result: su - intern, password qwerty12.

Task

With passwd, a user cannot set a password shorter than 12 characters or with fewer than three character classes (lowercase, uppercase, digits, others). A password that follows these rules is accepted.
The rules are written in /etc/security/pwquality.conf (or in a file in /etc/security/pwquality.conf.d/) — pwscore sees them.
After three wrong passwords in a row the account is locked for any password login: the console, su, sudo. A successful login before the lockout resets the counter.
Your own access is intact: student's key login, sudo and the console login work as before.

A mistake in /etc/pam.d can close both logins and sudo. Edit PAM from a root shell sudo -i and do not leave it until su - student -c 'sudo -n true' finishes without an error. There is no internet on the machine; everything you need is already installed.

Lab · on your own

No commands are given in this lab: type them in the terminal yourself. Goals are checked on the machine after every command.

Goals

0 of 4

pwscore rejects passwords shorter than 12 characters or with fewer than three classes and accepts a compliant one — not done yet
passwd does not let a user set a weak password and accepts a compliant one — not done yet
Three wrong passwords in a row lock the account for any password login, and a successful login resets the counter — not done yet
student logs in with the key, and sudo and the console login work as before — not done yet

Ctrl+Enter

Starts the machine node1 · Ubuntu 24.04

The machine is starting

Hints

0 of 3

Report a problem

Lab goals

0 of 4

pwscore rejects passwords shorter than 12 characters or with fewer than three classes and accepts a compliant one — not done yet
passwd does not let a user set a weak password and accepts a compliant one — not done yet
Three wrong passwords in a row lock the account for any password login, and a successful login resets the counter — not done yet
student logs in with the key, and sudo and the console login work as before — not done yet

node1 Ubuntu 24.04

Lab goals

0 of 4

pwscore rejects passwords shorter than 12 characters or with fewer than three classes and accepts a compliant one — not done yet
passwd does not let a user set a weak password and accepts a compliant one — not done yet
Three wrong passwords in a row lock the account for any password login, and a successful login resets the counter — not done yet
student logs in with the key, and sudo and the console login work as before — not done yet

Users and permissions · picked for this lab

passwd — change or lock a password

Cheat sheet

$_ — insert into the terminal

passwd change your own password
sudo passwd alice set someone's password, no old one needed
sudo passwd -S alice password status
sudo passwd -l alice lock password login
sudo passwd -u alice unlock
sudo passwd -e alice force a change at next login
sudo passwd -d alice delete the password (login without one!)
sudo passwd -x 90 -w 7 alice max age 90 days, warn 7 days ahead
echo 'alice:NewPass-2026' | sudo chpasswd from a script

chage shows password ages in more detail (chage -l alice). Full list of options — man passwd.

A temporary password for a new colleague

bash

sudo passwd alice          # set a temporary one
sudo passwd -e alice       # a new one is asked for at first login

Block login without deleting the account

bash

sudo passwd -l alice                  # the password no longer works
sudo usermod -s /usr/sbin/nologin alice   # interactive login closed too
sudo chage -E 0 alice                 # or expire the whole account

passwd -l closes only password login: an SSH key keeps working. To close login completely you also need nologin or chage -E 0.

Passwords for several users at once

bash

sudo chpasswd <<'EOF'
alice:Temp-Pass-1
bob:Temp-Pass-2
EOF

chpasswd reads name:password pairs. Don't leave such lines in the shell history or in files: they're passwords in plain text.

passwd: Authentication token manipulation error

passwd couldn't change the password. Causes by frequency: the current password was mistyped; the two entries of the new one didn't match (the line above says Sorry, passwords do not match.); the new password failed the checks — too short, too simple or too close to the old one. If root gets it and the password is clearly fine, check that the root filesystem isn't mounted read-only (findmnt /) and has free space (df -h /).

passwd: password unchanged

The closing line after any such failure. The line above it names the cause.

passwd: You may not view or modify password information

A regular user is trying to see or change someone else's password. Root is needed: sudo passwd -S alice.

The user still logs in after passwd -l

They log in with an SSH key: locking the password doesn't touch keys. Close login with sudo usermod -s /usr/sbin/nologin alice or sudo chage -E 0 alice.

I type the password and nothing appears

That's by design: the password isn't echoed. Type it fully and press Enter; if you lose track, Ctrl+U erases what you've typed.

`passwd -d` opens login without a password

After passwd -d the account has an empty password, and depending on PAM and SSH settings anyone can log in without typing anything. To forbid a password, use passwd -l, not -d.

The root password

sudo passwd root enables password login as root: on Ubuntu it's off by default, and administration goes through sudo. Don't turn it on without a reason.

PAM: password policy and lockout

Situation

Task

Signing in is needed to start the machine

A temporary password for a new colleague

Block login without deleting the account

Passwords for several users at once

passwd: Authentication token manipulation error

passwd: password unchanged

passwd: You may not view or modify password information

The user still logs in after passwd -l

I type the password and nothing appears

passwd -d opens login without a password

The root password

`passwd -d` opens login without a password