I've updated login.defs and password-auth to include a minimum length on passwords (12), but the minlen is not being enforced when I attempt to change a user's password with passwd. None of the password case policies are being enforced. I can enter 'aaaa1234' as a valid but weak and too short password.  I am also able to enter dictionary words, such as 'password'.  The same password can be reused. In summary, none of the settings in /etc/pam.d/password-auth appear to be recognized.  The password I'm entering for the following command is blue1234# passwd testyChanging password for user testy.New password: BAD PASSWORD: it is based on a dictionary wordBAD PASSWORD: is too simpleRetype new password: passwd: all authentication tokens updated successfully.Here's what was logged in /var/log/secure from the operation above. This is the only line for the event. Apr  1 11:41:37 myserver passwd: pam_unix(passwd:chauthtok): password changed for testyconfig files# login.defs# Password aging controls:##       PASS_MAX_DAYS   Maximum number of days a password may be used.#       PASS_MIN_DAYS   Minimum number of days allowed between password changes.#       PASS_MIN_LEN     12#       PASS_WARN_AGE   Number of days warning given before a password expires.#PASS_MAX_DAYS   30PASS_MIN_DAYS   1PASS_MIN_LEN     12PASS_WARN_AGE   14.# /etc/pam.d/password-auth#%PAM-1.0# This file is auto-generated.# User changes will be destroyed the next time authconfig is run.auth        required      pam_env.soauth        sufficient    pam_unix.so nullok try_first_passauth        requisite     pam_succeed_if.so uid >= 500 quietauth        required      pam_deny.soauth        [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900auth        required      pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900account     required      pam_unix.soaccount     sufficient    pam_localuser.soaccount     sufficient    pam_succeed_if.so uid < 500 quietaccount     required      pam_permit.sopassword    requisite     pam_cracklib.so try_first_pass retry=3 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 minlen=12password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtokpassword    required      pam_deny.sosession     optional      pam_keyinit.so revokesession     required      pam_limits.sosession     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uidsession     required      pam_unix.soWhy is the pam password policy not being enforced?PS: This is a minimal installation.
Policy in /etc/pam.d/password-auth is not being enforced
linux;centos;login;password
You have to check your /etc/pam.d/passwd file if it includes /etc/pam.d/password-auth or /etc/pam.d/system-auth and to make required changed in file which is included.  In short:An application that uses PAM can have a configuration file bearing its name in /etc/pam.d/. If a file exists, the rules in that file are processed whenever the application calls a PAM authentication function.Files like /etc/pam.d/system-auth and to a larger extent /etc/pam.d/password-auth are somewhat distribution-specific.  Since no applications identify themselves as system-auth or password-auth, these files are actually never called on their own. Instead, the contents of these files are pulled into other PAM configuration files with the include directive. That way, common settings for multiple applications can be stored in a single file.