I have been working on customizing the password policy on CentOS. I know most of what I want to set can be done in the file /etc/pam.d/system-auth, which I have successfully augmented. However, in testing I found that very little information is displayed when insufficient password are entered. For example, when the new password entered does not have a non-alpha-numeric character it simply returns "Bad Password: is too simple."


How can I get passwd to display the password policy or at least make it easier to understand what kind of password is acceptable? Thanks.

Are you using a script to accomplish this?

This link describes what I am doing.

http://www.puschitz.com/SecuringLinu...ongerPasswords

I am just adding flags to the pam-cracklib.so module.

mmmmmmh......... in that case I'm afraid I won't be able help you. However, I'm sure that there is someone else here on the forums that will.

I wish you success!!

The reason it does that is for security; you should give away the minimum info (preferably none) to a possible attacker.
Traditionally for login, it only supplies an error after both(!) username & passwd have been supplied, and often it just says 'Invalid Login' so that you don't know if the username or passwd was wrong (or both).

If you DO want to publish the passwd requirements, you could use the banner or issue file, but normally users are only told at registration, either via a separate path, or on the registration page.
See also 'lost passwd' procedures.

You could use pam_exec to call your own program I suppose.

Thank you for your response. To be more clear, I want to show the password policy when a user is changing or setting their password. At the moment, if a user is updating their password it does not supply enough information to understand why the new password is not accepted. I can foresee users being unable to set their password if my policy is decently complex because it does not state what criteria was not met , it simply says "Bad Pass".

The problem is there's no way for the system to know its a legit user trying to change their passwd vs a cracker just guessing.

This is why its often done OOB (Out Of Bounds) eg via email when their initial acct is setup for them, or just displayed on an intranet Wiki.

Ok here's how to create+show pre-login banners for term sessions and for ssh logins
http://www.cyberciti.biz/faq/howto-c...login-message/
http://www.cyberciti.biz/tips/change...in-banner.html

If you want to only show a msg IF they fail, I think you'll need to customise the use of pam_unix, but its not evident to me how to do that.

I think you should consider asking the Mods (via the Report button) to move this to the Security forum.
I'm curious about the soln myself now ...