It's important to use strong passwords on your Linux system. Weak passwords will be found by a brute-force attack or where a passwd/shadow file is subject to an offline password cracking attack. You should avoid reusing passwords between systems to prevent attacks using lists of leaked passwords.

Install pam_pwquality

Ubuntu supplies the pam_pwquality module to add basic password quality checks. Depending on how you have installed Ubuntu, it may not be installed or enabled by default. This can be enabled by installing the libpam_pwquality package.

After installing the package, the pam-auth-update utility (run as root) will present you with a menu. Ensure that "Pwquality password strength checking" is enabled.

Verify installation of pam_pwquality

After installation and configuration, pam_pwquality will be present in the /etc/pam.d/common-password file. The common-password file will be referenced with @include common-password in other /etc/pam.d service files, including login, passwd, lightdm, gdm-password, and sshd (depending on installed services some of these files may be absent).

Example line from common-password enabling pam_pwquality, it should be present before any lines for pam_sss.so or pam_unix.so:

password        requisite        pam_pwquality.so retry=3

Last reviewed: 
03/07/2025