# PAM and Password complexity

**URL:** <https://forums.suse.com/t/pam-and-password-complexity/27440>\
**Category:** SLES Configure-Administer\
**Created:** [September 17, 2015, 3:03am UTC](https://forums.suse.com/t/pam-and-password-complexity/27440 "2015-09-17T03:03:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jombiejp](https://avatars.discourse-cdn.com/v4/letter/j/8edcca/32.png) [@jombiejp](https://forums.suse.com/u/jombiejp)\
**Post date:** [September 17, 2015, 3:03am UTC](https://forums.suse.com/t/pam-and-password-complexity/27440/1 "2015-09-17T03:03:11Z")

</div>

Hi,  
I’m using SLES 10 and have a need to prevent users from using their username in their password.  
Currently, my /etc/pam.d/common-password shows:  
password required pam\_pwcheck.so  
password required pam\_cracklib.so use\_authtok difok=4 retry=3 minlen=12 lcredit=-2 ucredit=-2 dcredit=-2 ocredit=-2  
password required pam\_pwcheck.so remember=24 use\_authtok use\_first\_pass  
password required pam\_unix2.so use\_authtok use\_first\_pass

I know Redhat’s pam\_cracklib supports reject\_username, but it doesn’t seem to work with SLES10.

Does anyone have any idea how I can accomplish this?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![maikcat](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@maikcat](https://forums.suse.com/u/maikcat)\
**Post date:** [September 17, 2015, 8:21am UTC](https://forums.suse.com/t/pam-and-password-complexity/27440/2 "2015-09-17T08:21:01Z")

</div>

SLES11 pam\_cracklib do supports reject\_username parameter as i use it…

unfortunately i dont have any SLES10 systems…

Michael.

---

<div class="post-metadata">

**Author:** ![maikcat](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@maikcat](https://forums.suse.com/u/maikcat)\
**Post date:** [September 17, 2015, 8:23am UTC](https://forums.suse.com/t/pam-and-password-complexity/27440/3 "2015-09-17T08:23:31Z")

</div>

SLES11 pam\_cracklib module do support reject\_username param

unfortunately i dont have any SLES10 systems to check it…

Michael.

---

<div class="post-metadata">

**Author:** ![Jens-U](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@Jens-U](https://forums.suse.com/u/Jens-U)\
**Post date:** [September 17, 2015, 5:50pm UTC](https://forums.suse.com/t/pam-and-password-complexity/27440/4 "2015-09-17T17:50:42Z")

</div>

Hi jombiejp,

[QUOTE=jombiejp;29638]Hi,  
I’m using SLES 10 and have a need to prevent users from using their username in their password.  
[…]  
I know Redhat’s pam\_cracklib supports reject\_username, but it doesn’t seem to work with SLES10.[/QUOTE]

SLES10 is pretty old 😉 The first SLES version I remember to ship pam\_cracklib with support for that parameter was SLES11SP3 - maybe SLES11SP2 had it, SP1 didn’'t.

[QUOTE=jombiejp;29638] Does anyone have any idea how I can accomplish this?[(QUOTE]

Not quite the same, I know, but how about periodically updating a pam\_cracklib dictionary with all the current user names in it?

Regards,  
Jens

---

<div class="post-metadata">

**Author:** ![jombiejp](https://avatars.discourse-cdn.com/v4/letter/j/8edcca/32.png) [@jombiejp](https://forums.suse.com/u/jombiejp)\
**Post date:** [September 18, 2015, 12:16am UTC](https://forums.suse.com/t/pam-and-password-complexity/27440/5 "2015-09-18T00:16:49Z")

</div>

Yeah. SLES10 is rather old, but it’s what we have 🙂  
Thanks for the idea jmozdzen