In a RHEL7 server, I have to implement two password policies that can be described as parameters of PAM pam_pwquality module:
- password requisite pam_pwquality.so try_first_pass local_users_only minlen=14
- password requisite pam_pwquality.so try_first_pass local_users_only dcredit=0 ucredit=0 ocredit=0 lcredit=0 minclass=3 maxsequence=1
Furthermore the default RHEL 7 PAM configuration contains already the following entry of pam_pwquality:
- password requisite pam_pwquality.so try_first_pass local_users_only retry=3
I have the requirements to apply the password policy of entry 3 to all users and the password policy to two differents groups of local user named group1 and group2.
To apply this requirements, I have added the following code in /etc/pam.d/password-auth-ac and /etc/pam.d/system-auth-ac after the default pam_pwquality entry (named 3. in this question):
password requisite pam_pwquality.so try_first_pass local_users_only minlen=14 # Default RHEL7 pam_pwquality.so entry
#BEGIN PWPOLICY 1
password [success=1 default=ignore] pam_succeed_if.so user notingroup group1
password requisite pam_pwquality.so try_first_pass local_users_only minlen=14 use_authtok
#END PWPOLICY 1
#BEGIN PWPOLICY 2
password [success=1 default=ignore] pam_succeed_if.so user notingroup group2
password requisite pam_pwquality.so try_first_pass local_users_only dcredit=0 ucredit=0 ocredit=0 lcredit=0 minclass=3 maxsequence=1 use_authtok
#END PWPOLICY 2
This configuration works as expected but it has the disadvantage that when a user (included in group1 and group2) change the password it needs to repeat it multiple times, as showed in the following example:
[test@rhel7 ~]$ passwd
Changing password for user test.
Changing password for test.
(current) UNIX password:
New password:
Retype new password:
Retype new password:
Retype new password:
passwd: all authentication tokens updated successfully.
The option "use_authtok" included in my last two pam_pwquality entries seems to be ignored.
Do you know what is wrong with this configuration or other methods to implements these requirements?
