Hi all,

I am using pam module to set password policy in my SuSE linux machine. This is my /etc/pam.d/common-password file:


password required pam_cracklib.so retry=3 minlen=8 dcredit=-1 lcredit=-1 ucredit=-1 ocredit=-1
password required pam_pwhistory.so use_authtok remember=3
password required pam_unix2.so use_authtok nullok

Now if root user tries to change the password of a normal user, giving the same password, it is throwing an error saying "Password has been already used. Choose another".

Example:
> passwd user1
> password1 (set successfully)
> passwd user1
> password1 (Password has been already used. Choose another)

This should not happen with the root user. So is there any explanation for this?
Thanks in advance

This seems to answer your question: pam retains a history of passwords and won't allow you to reuse a password stored in that history. The default number of passwords to remember is 400, but the config line quoted above resets the number to 3.

You can read more about it http://www.deer-run.com/~hal/sysadmin/pam_cracklib.html

Scroll down to the section labeled Password History.

Yeah true.. but I thought all these policies will not be applicable for root user unless we specify it externally. I was trying to modify the user's password from root !!