Server security / Stage 4 of 10

PAM: password policy and lockout

Not running Starting usually ~20 s

Step 8 of 8 · summary · 2 min

Summary

Login and password changes are checked by PAM: common-auth the password at login, common-password the change; module sets are enabled with pam-auth-update.
pwquality sets the password policy (minlen, minclass in /etc/security/pwquality.conf) and applies when an ordinary user changes a password; root and chpasswd bypass it.
faillock counts misses in common-auth and locks an account after deny failures; the lock is cleared by faillock --reset.
pwscore rates a password without changing it; faillock --user <name> shows the misses.
The weak password from the start of the lesson went through, and a dozen misses stopped nothing, because a fresh image has neither a quality policy nor login lockout — you added both yourself.

Ubuntu 24.04