pam_cracklib does not enforce uppercase when specified

  • 7007427
  • 27-Dec-2010
  • 30-Apr-2012


SUSE Linux Enterprise Server 10 Service Pack 3
Novell Open Enterprise Server 2 (OES 2) Linux Support Pack 2


Version of cracklib is 2.8.6-14.10

/et/cpam.d/common-password has the following entry:
password required dcredit=-1 ucredit=-1 ocredit=0 lcredit=-1 minlen=8
password required nullok user_authtok

A digital, uppercase and lowercase are required with a minimum password length of 8.

When a user sets their password they can set a password in all lower case even though ucredit=-1.


The pam_cracklib.c in sp4 resolves this issue.


Reported to Engineering