I'm doing Red Hat (RHEL 6.5) security settings. If I set up the two files as shown below, is there no security effect on each other?

  1. /etc/pam.d/system-auth
password requisite pam_cracklib.so retry=3 minlen=8 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1
  1. /etc/login.defs

Is it okay to set the minimum password length differently as above? I'd appreciate it if you could explain the difference or relevance between the two files.

  • If you're concerned about security, you may want to use something other than RHEL 6.5. I don't believe that's receiving any security updates, which is probably going to have more impact on your security than those settings.
    – bk2204
    Jan 17 at 22:32
  • I'm using it on a specific system, so I can't use another version. Thanks for the additional comments. Jan 20 at 5:56
  • in recent manual for login.defs it is mentioned that passwd no longer uses it and settings should be defined through PAM modules (man7.org/linux/man-pages/man5/login.defs.5.html#BUGS). Also for modern passwd, if it is compiled with PAM support (and it almost certainly is on normal system) it will just use defaults from PAM module (see getdefs.c from shadow library sources). Jan 30 at 21:07
  • Your answer is very helpful. Thank you! @MaciejWrobel Feb 9 at 0:37


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.