I have the following settings in file /etc/pam.d/common-password.password        requisite                       pam_cracklib.so retry=3 lcredit=-1 ucredit=-1 dcredit=-1password        [success=1 default=ignore]      pam_unix.so obscure use_authtok try_first_pass sha512password        requisite                       pam_deny.sopassword        required                        pam_permit.sopassword        optional        pam_ecryptfs.soWhy can root set a weak password for another user?root@kali:~# LANG=C passwd kaliNew password: BAD PASSWORD: it is WAY too shortBAD PASSWORD: is a palindromeRetype new password: passwd: password updated successfullyI don't see any pam rule that is allowing it. Am I missing something?
Why root is not constrained by pam
kali linux;password;root;pam
In newer (and backported into RHEL 6) versions of PAM, there is an option to pam_cracklib you want to add  enforce_for_root. This is off by default. Just add it to that line, and there you go.Of course, without a lot of other constraints (SELinux, say), root can always go around PAM and set the password another way (like, writing directly to the appropriate file), so consider this more of a way of keeping yourself honest rather than solid restriction.Why does it work this way rather than expecting the stack to take care of that kind of thing? I think it's just a matter of flexibility, especially back when the PAM control values were just the simple required/requisite/sufficient/optional  you'd have to put pam_rootok with a control value of sufficient above all of the checks that root would ignore, but only those. Since the option to succeed as root is built into pam_cracklib itself, that's not necessary (assuming that allowing root to skip the check is desired, which it apparently is, even if not in your case).