Our password requirements include:
1. Minimum length of password is 8 characters. (This password will expire in 90 days.)
2. If password is 13 characters or greater, password will never expire.

NOTE: I already have a script that manages password expiration instead of using pam.

Shown below is my attempt in /etc/pam.d/system-auth. What I am trying to accomplish is to run a script only if the user inputs a 13 character password. So far I have not found any configuration in pam that will accomplish this. Can anyone please help me in determining if this is possible with pam?

Attempt with /etc/pam.d/system-auth:

password requisite pam_cracklib.so try_first_pass retry=3 minlen=8

password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok

password optional pam_cracklib.so try_first_pass retry=3 minlen=13

password optional pam_exec.so /usr/bin/password_donot_expire.sh

password required pam_deny.so

No PAM does not have any such option which I am aware of. The reason is you are asking PAM to make decision and modify another attribute. PAM does make decision of rejecting or accepting password on the basis of length. Asking PAM to check if password is 13 characters and if yes set to non-expiry that will be too much for PAM. PAM is not designed for that. Ofcourse, you can have script like you said to coordinate with PAM but solely leaving it on PAM will simply doesn't work.

Another thing is why would you set a password to non-expiry just because it is long. I mean I can set the password "abcdefgh123456" quite easy to guess but it is long and ok to be set to non-expiry. Length of the password doesn't matter but complexity does. You might want to add requirement for minimum number of upper case, lower case, special character and numbers to your password complexity requirement in PAM.