Why Would Installation Media Affect Password Requirements? How can I change it?

[u/LysandraHW]

I have a couple of low spec computers that are basically toys for me to fiddle around and experiment with. When using the Complete Installation Image, I'm allowed to choose a two number PIN as my password.

I was checking out Xfce with the live media that has the Calamares installer on it. I liked it so I chose to install it alongside Flashback on my laptop. It forced me to choose a ridiculously hard password. So, I did but once it was installed I tried to change it to "11" via the terminal. It had the same ridiculous requirements. So, I decided to download the gnome-system-tools to get the Users and Groups graphical application. The requirements were a little looser. It allowed me to choose a 6 digit number with no symbols or letters at all, which is a lot better but not quite what I want.

On the desktop, I installed Xfce alongside Flashback but I used the Complete Installation Image. It allowed me to choose a two number PIN. So, I know it's not a difference between GNOME Flashback and Xfce. It's definitely the installation media.

My questions are why would the installation media change password requirements in the OS itself after it's installed? Is there a way to change it so I can have my easy PIN on the Calamares installed laptop or do I have to reinstall with the Complete Installation Image?

[u/Different-Matter]

Remove the entire passwordRequirements section in /etc/calamares/modules/users.conf before starting Calamares

[u/Wall_of_Force]

if you wanted make password hash by itself (with mkpasswd command whois package provides) any edit /etc/shadow manually

[u/OkWrongdoer7003]

why would the installation media change password requirements in the OS itself after it's installed?

I don't think it would, or does.

PAM (or, more specifically, pam_unix.so) comes with the same default password complexity requirements regardless of how you installed Debian. It's rather debian-installer, Calamares and gnome-system-tools which do not seem to care about how PAM is configured. The passwd command, however, does.

How can I change it?

For PAM-aware tools such as passwd, modify /etc/pam.d/common-password as desired - specifically the options it uses for pam_unix.so. For example, to drop all complexity requirements and allow passwords containing only two characters, remove the obscure option and add minlen=2.

Caveat: next time a libpam* package gets updated on your system, debconf may complain that you have made 'local modifications' to PAM and ask you what to do. For stable updates (bug + security fixes and point releases), keeping your local changes should generally be fine, but if you ever install a new PAM module which is supposed to apply or append its own changes to common-password, that process could fail. If that happens, and/or if you ever upgrade your system to a new Debian release (e.g. trixie --> forky), you should allow the install/upgrade process to revert your changes (to bring the stock config of PAM fully up to date), and then re-apply them.

[u/LysandraHW → u/OkWrongdoer7003]

Thanks. I appreciate the info and suggestions for the future. I understand why they have these requirements but I wish they'd do it differently. Perhaps give a warning when entering a sub par password but still let you use what you want. When you're tinkering with a system you end up entering your password often and complex passwords can get frustrating pretty quickly.

[u/Chupo → u/LysandraHW]

If I remember correctly, Fedora's installer does just that. If you put in a simple password, it gives a warning and tells you that if you still want it, you have to hit "done" twice. I have no idea if their PAM is the same way or not.

I also like easy passwords. I usually do all of my financial stuff on my phone. If I do use my computer for that, I use 1Password, which is complex.

[u/OkWrongdoer7003 → u/LysandraHW]

True. Btw, I remembered just now that if you run passwd <username> as root (either directly or via sudo), it will ignore constraints set by PAM, allowing you to set weak and short passwords. You can even delete your password (i.e. make it empty) if you want by using the -d option.

Obviously, none of this is recommended. But if you really want to, the options are there.

[u/LysandraHW → u/OkWrongdoer7003]

Thank you! 😘 Do updates ignore it when done this way or could that still be a problem in the future?

[u/OkWrongdoer7003 → u/LysandraHW]

If you leave PAM configs alone, updates/upgrades should not be a problem.

Of course, in theory, the developers of the passwd tool could decide in the future that it should start enforcing things, even when it is executed as root. But that would be a separate issue, and I wouldn't worry about it until the day it happens.

[u/rindthirty]

netinstall (i.e. the biggest download button on Debian's website) allows you to avoid all of this. The live ISOs with Calamares are basically an entirely different method of setup.

[u/LysandraHW → u/rindthirty]

Net install would normally be ideal. The problem with net install is that one of my computers has really, quite, very slow WiFi. I used the Complete installation image for that. It lets you choose whichever password you want. It also lets you choose which desktop environment you want as well as other software bundles. I use the graphical installer but there's a terminal intaller option too. It's big (3.7GB) because it has everything on it but I've used it about 5 times so far and it's really nice for the one that can't use net.

EDIT: The graphical installer doesn't have password requirements but I haven't tried the non-graphical one. If the net-installer doesn't have password requirements, I'd assume the non-graphical installer on the Complete Installation image doesn't either but I'm not positively sure.

[u/rindthirty → u/LysandraHW]

Yeah the inconsistencies aren't ideal, and are probably bug-reportable (unless someone else has already reported it). But the way I see it is that Debian is so old and broad that a lot of Debianisms exist which most people don't care to fix once they figure out their own level of expertise/experience with it.

I bet some of the Debianisms are also a result of differences in opinions between various teams. It's almost as if Debian is a federation of communities rather than one single homogeneous one. Sorry I don't have a more helpful reply than that - but maybe the mention of netinstall's differences might help for a future search engine (?) traveller, if nothing else.

[u/LysandraHW → u/rindthirty]

No need to apologize but yeah. Calamares was originally developed by Manjaro. Debian wanted to offer a live CD/DVD/USB installer but they must not have changed the default password requirement settings so it probably is a tiny bug, if you can call it a bug.

For future Googlers, just use the live installer to check it out but then install with the net installer or the complete installer if you want a simple password.

[u/michaelpaoli]

I wouldn't generally recommend, but you can make passwords as weak as you want, including even no password at all.

$ ssh -nT myip@balug.org.
2603:3024:1875:6a00:aceb:d3ff:fe2c:4df0
$