How to Configure Linux Pam (pluggable Authentication Modules) to Enforce Password Policies and Two-factor Authentication on Ubuntu

ByAkensai

Learning how to configure Linux PAM (Pluggable Authentication Modules) to enforce password policies and two-factor authentication on Ubuntu is one of the most effective ways to harden your server’s security. PAM sits between your applications and the operating system’s authentication layer. It controls who gets in, how they prove their identity, and what rules their passwords must follow. Whether you’re running a production web server or a personal VPS, weak authentication is a serious risk. This tutorial walks you through installing the required PAM modules, setting strict password policies, and enabling time-based one-time password (TOTP) two-factor authentication using Google Authenticator. By the end, you’ll have a significantly more secure Ubuntu system.

Prerequisites and Requirements for Configuring Linux PAM on Ubuntu

Before you start, make sure you have the following in place.

System requirements:

  • Ubuntu 20.04 or 22.04 LTS (these steps work on both)
  • A non-root user with sudo privileges
  • SSH access to your server
  • Basic familiarity with the Linux command line

Software you’ll install:

  • libpam-pwquality , enforces password complexity rules
  • libpam-google-authenticator , adds TOTP-based two-factor authentication

Estimated time: 30–45 minutes

Important warning: Always keep a second SSH session open while editing PAM configuration files. A misconfigured PAM file can lock you out of your own server. Test every change before closing your active session.

You should also make a backup of any PAM file before editing it. This is not optional. One typo in a PAM config can make your system unbootable or inaccessible remotely.

Step-by-Step Guide to Enforce Password Policies and Two-Factor Authentication

For a related walkthrough, see: How to Migrate Wordpress Classic Meta Boxes to Modern Block Editor Sidebar for Wordpress 7.0

Follow these steps carefully and in order.

Step 1: Update your system packages

Start by making sure your package list is current.

sudo apt update && sudo apt upgrade -y

This ensures you’re installing the latest versions of all modules.

Step 2: Install the password quality library

Install libpam-pwquality to enforce strong password rules.

sudo apt install libpam-pwquality -y

This package provides the pam_pwquality.so module. It integrates directly with PAM and checks passwords against a set of configurable rules.

Step 3: Configure password complexity rules

Open the pwquality configuration file.

sudo nano /etc/security/pwquality.conf

Add or update these settings:

minlen = 12
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1
maxrepeat = 3
retry = 3

Here’s what each line does:

  • minlen = 12 , requires at least 12 characters
  • dcredit = -1 , requires at least one digit
  • ucredit = -1 , requires at least one uppercase letter
  • lcredit = -1 , requires at least one lowercase letter
  • ocredit = -1 , requires at least one special character
  • maxrepeat = 3 , blocks more than 3 repeated characters in a row
  • retry = 3 , allows 3 attempts before failing

Save and close the file with Ctrl+X, then Y, then Enter.

Step 4: Apply the policy to the PAM common-password file

Back up the file first.

sudo cp /etc/pam.d/common-password /etc/pam.d/common-password.bak

Now open it for editing.

sudo nano /etc/pam.d/common-password

Find this line:

password requisite pam_pwquality.so retry=3

If it doesn’t exist, add it near the top of the password section. This line tells PAM to apply the pwquality rules whenever a user sets a new password. The requisite keyword means the check must pass before anything else runs.

Step 5: Set password expiration policies

You can enforce password expiration using /etc/login.defs. Open the file.

sudo nano /etc/login.defs

Update these values:

PASS_MAX_DAYS   90
PASS_MIN_DAYS   7
PASS_WARN_AGE   14

This forces users to change their password every 90 days. They can’t change it again for 7 days. They’ll get a warning 14 days before it expires. These settings apply to new accounts. For existing users, run:

sudo chage --maxdays 90 --mindays 7 --warndays 14 username

Replace username with the actual account name.

Step 6: Install Google Authenticator for two-factor authentication

Install the PAM module for TOTP-based 2FA. You can read more about PAM modules in the official Ubuntu PAM documentation.

sudo apt install libpam-google-authenticator -y

Step 7: Set up Google Authenticator for your user

Run this command as the user you want to protect (not as root).

google-authenticator

Answer the prompts as follows:

  • Time-based tokens: Yes
  • Update your .google_authenticator file: Yes
  • Disallow multiple uses of the same token: Yes
  • Allow tokens up to 4 minutes old: No
  • Enable rate limiting: Yes

Scan the QR code with an authenticator app such as Google Authenticator or Authy. Save your emergency scratch codes somewhere safe.

Step 8: Configure PAM to require two-factor authentication for SSH

Back up the SSH PAM file first.

sudo cp /etc/pam.d/sshd /etc/pam.d/sshd.bak

Open the file.

sudo nano /etc/pam.d/sshd

Add this line at the top of the file:

auth required pam_google_authenticator.so

Now update your SSH daemon configuration.

sudo nano /etc/ssh/sshd_config

Find and update these lines:

ChallengeResponseAuthentication yes
UsePAM yes

Restart SSH to apply the changes.

sudo systemctl restart sshd

Test your SSH login in a new terminal window before closing your current session. You should be prompted for both your password and your TOTP code. For more details on securing SSH, check the official OpenSSH documentation.

Troubleshooting Common PAM Configuration Issues

Problem: Locked out after editing PAM files
If you lose access, boot into recovery mode. From the recovery console, restore your backup files. This is exactly why you kept that second session open.

Problem: Password changes aren’t enforcing complexity rules
Check that pam_pwquality.so appears before pam_unix.so in /etc/pam.d/common-password. Order matters in PAM configuration.

Problem: SSH isn’t asking for a TOTP code
Make sure ChallengeResponseAuthentication yes is set in /etc/ssh/sshd_config. Also confirm the service restarted cleanly with sudo systemctl status sshd.

Problem: Google Authenticator file not found
The .google_authenticator file must exist in the home directory of the user logging in. Run google-authenticator as that specific user, not as root.

Problem: Time-based codes are rejected
TOTP codes are time-sensitive. Make sure your server’s clock is synchronized. Run sudo timedatectl status and check that NTP is active.

Conclusion

You now know how to configure Linux PAM (Pluggable Authentication Modules) to enforce password policies and two-factor authentication on Ubuntu. You’ve set strict complexity requirements, applied password expiration

Similar Posts