The easiest workaround is using other display manager like gdm. But a possible workaround is using libpam-passwdqc(universe) instead of libpam-cracklib(main). With "enforce=everyone"(default), it can reject a password which does not meet requirements even if changed by root.
But it cannot cover all requirement other pam modules have, e.g. "reject_username" in pam_cracklib and "remember=n" in pam_unix. -- You received this bug notification because you are a member of Desktop Packages, which is subscribed to lightdm in Ubuntu. https://bugs.launchpad.net/bugs/1128226 Title: lightdm accepts weak password although pam says BAD PASSWORD Status in “lightdm” package in Ubuntu: Triaged Bug description: Even if libpam-cracklib installed, lightdm accepts too short password. This might be a security issue because user can ignore password policy defined by root. How to reproduce: 1. install libpam-cracklib 2. create "user1" with password "foo" 3. expire user1's password by root $ sudo passwd -e user1 4. try to login as user1 on lightdm with password "foo" 5. get "You are required to change password" message and be prompted to input new password Expected results: if you input too short password like "bar" in the box, then lightdm rejects it and re-prompt to type stronger password. Actual results: if you input too short password like "bar" in the box twice, then lightdm accept it and change password with too short one although saying that "BAD PASSWORD: it is WAY too short" and "BAD PASSWORD: is too simple" NOTE: passwd command with user privilege, properly reject too short password like below: $ passwd (current) UNIX password: #<- type "foo New password: #<- type "bar" BAD PASSWORD: it is WAY too short New password: #<- type "bar" BAD PASSWORD: it is WAY too short New password: #<- type "bar" BAD PASSWORD: it is WAY too short passwd: Have exhausted maximum number of retries for service passwd: password unchanged Changing password for user1. ProblemType: Bug DistroRelease: Ubuntu 13.04 Package: lightdm 1.4.0-0ubuntu4 ProcVersionSignature: Ubuntu 3.8.0-6.13-generic 3.8.0-rc7 Uname: Linux 3.8.0-6-generic x86_64 ApportVersion: 2.8-0ubuntu4 Architecture: amd64 CasperVersion: 1.330 Date: Sun Feb 17 16:26:19 2013 LightdmConfig: [SeatDefaults] user-session=ubuntu greeter-session=unity-greeter LiveMediaBuild: Ubuntu 13.04 "Raring Ringtail" - Alpha amd64 (20130217) MarkForUpload: True ProcEnviron: TERM=linux PATH=(custom, no user) XDG_RUNTIME_DIR=<set> LANG=en_US.UTF-8 SHELL=/bin/bash SourcePackage: lightdm UpgradeStatus: No upgrade log present (probably fresh install) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lightdm/+bug/1128226/+subscriptions -- Mailing list: https://launchpad.net/~desktop-packages Post to : [email protected] Unsubscribe : https://launchpad.net/~desktop-packages More help : https://help.launchpad.net/ListHelp
