Changes/UsePAMInChpasswdNewusers

Use PAM in chpasswd and newusers

Summary

Enable PAM (Pluggable Authentication Modules) support for the chpasswd and newusers utilities. This ensures that these tools follow the system-wide authentication and password policies (such as password complexity, history, and auditing) defined in the Fedora PAM stack.

Owner

• Name: Iker Pedrosa
• Email: <ipedrosa@redhat.com>

Current status

• Targeted release: Fedora Linux 45
• Last updated: 2026-04-24
• Announced
• Discussion thread
• FESCo issue: #3589
• Tracker bug: #2461179
• Release notes tracker: #396

Detailed Description

Currently, the chpasswd and newusers binaries (provided by the shadow-utils package) update passwords directly without interacting with PAM. This means they can bypass security constraints defined in /etc/pam.d/system-auth, such as:

• Password quality requirements (pam_pwquality).
• Password history (pam_pwhistory).
• Account locking/unlocking logic.
• Centralized logging and auditing of password changes.

This proposal aims to modify these utilities to initialize a PAM session, allowing them to be "good citizens" within the Fedora security ecosystem and ensuring that administrative bulk updates respect the same rules as the passwd command.

This change addresses the issue reported in https://bugzilla.redhat.com/show_bug.cgi?id=2283963

Benefit to Fedora

• Consistency: centralizes password policy enforcement. Administrators can be sure that policies set in PAM apply when using bulk update tools.
• Security: prevents the accidental setting of weak passwords via automation scripts that use chpasswd.
• Auditing: provides better traceability of password changes through standard PAM logging.

Scope

• Proposal owners: modify shadow-utils dist-git to enable PAM support for chpasswd and newusers. Provide and package the corresponding PAM service files: /etc/pam.d/chpasswd and /etc/pam.d/newusers. Probably basing them on the existing passwd stack.

• Other developers: N/A

• Release engineering: N/A

• Policies and guidelines: N/A

• Trademark approval: N/A

• Alignment with the Fedora Strategy: N/A

Upgrade/compatibility impact

Minimal. Scripts that rely on setting passwords that violate current PAM policies might fail (which is the intended security behavior). Administrators might need to adjust their PAM configurations if they want specific "relaxed" rules for these tools.

How To Test

No special hardware or configuration is required to test this change.

1. Install the updated shadow-utils package.
2. Define a strict password policy in /etc/security/pwquality.conf (e.g., minlen = 20).
3. Attempt to change a password using echo "user:short" | chpasswd.
4. Expected result: The command should fail, citing that the password does not meet the complexity requirements.

User Experience

End-users won't notice a change. System administrators will have a more robust and predictable environment where security policies are enforced consistently across all tools.

Dependencies

This is an update to shadow-utils package and there are no external dependencies

Contingency Plan

• Contingency mechanism: revert the changes in shadow-utils to the previous behaviour
• Contingency deadline: Beta Freeze.
• Blocks release? No

Documentation

No documentation update.

Release Notes

The chpasswd and newusers utilities now support PAM. This ensures that bulk password updates and user creations respect system-wide password policies, such as complexity and history requirements.