How do you configure /etc/pam.d/system-auth-ac on CentOS 6 using authconfig?

Question

I'm trying to replace the cracklib module with passwdqc. Every time I do an authconfig --update (or --updateall), the changes I make on the system-auth-ac file goes away. The authconfig command line or system-config-authentication don't have any options pertaining to passwdqc. I also need to add arguments to the passwdqc module.

Solution

If you want to enable pam_passwdqc:

• Replace the pam_cracklib line in /etc/pam.d/system-auth-ac with pam_passwdqc.
• Remove USECRACKLIB=yes from /etc/sysconfig/authconfig

Now, run authconfig --update and you should find that pam_passwdqc is still enabled.

Comments

[Hermes Conrad]

Thanks. It worked. To change it back to use cracklib, all I had to do was to change USECRACKLIB to yes in /etc/sysconfig/authconfig, or change the passwdqc line in /etc/pam.d/system-auth-ac back to cracklib. I did not have to change 2 configuration files. Is there any documentation about this? I couldn't find in the man pages of authconfig, system-auth-ac and passwdqc anything relating /etc/sysconfig/authconfig to any of the /etc/pam.d/ files.