Take the 2-minute tour ×

I just had a strange experience. I created a new user on a server (Ubuntu 10.04, Plesk installed) and then wanted to set the password. Look at that output:

# useradd dev
# passwd dev
Enter new password:
Retype new password:
Geben Sie ein neues UNIX-Passwort ein: 
Geben Sie das neue UNIX-Passwort erneut ein:

I had to give a password 4 times. The latter 2 prompts are in german. The password for the latter 2 requests needed to differ from the one given first. What's going on here?

update: # cat /etc/pam.d/passwd # # The PAM configuration file for the Shadow `passwd' service #

@include common-password

# cat /etc/pam.d/system-auth
cat: /etc/pam.d/system-auth: Datei oder Verzeichnis nicht gefunden

(/etc/pam.d/system-auth doesn't exist) Btw. can I somehow set all such output to be english, without changing system locale (which may affect other things)?


# cat /etc/pam.d/common-password 

password optional pam_plesk.so try_first_pass
password        [success=1 default=ignore]      pam_unix.so obscure sha512
# here's the fallback if no module succeeds
password        requisite                       pam_deny.so
# since the modules above will each just jump around
password        required                        pam_permit.so
# end of pam-auth-update config

Looks like Plesk is the culprit. Correct?

share|improve this question
Can you provide /etc/pam.d/passwd and /etc/pam.d/system-auth if they exist? If they dont exist what distro are you running? –  Patrick Mar 18 '12 at 2:10
@Patrick: "Ubuntu 10.04, Plesk installed", as per the question. –  womble Mar 18 '12 at 2:53
Please provide /etc/pam.d/common-password as well. –  jollyroger Mar 18 '12 at 11:02
add comment

1 Answer

up vote 2 down vote accepted

The passwd command uses PAM (Pluggable Authentication Modules), which ask the user for passwords and update password hashes in /etc/shadow and/or any other auth backends you've configured. PAM for the passwd command is configured in /etc/pam.d/passwd, which, in your case, merely includes /etc/pam.d/common-password.

You can read a quick introduction about PAM with man 7 pam.

Now I'm not familiar with Plesk, and I'm still a bit of an amateur when it comes to PAM, but I'd be inclined to swap the first two non-blank, non-comment lines so that pam_unix comes before pam_plesk:

password        [success=1 default=ignore]      pam_unix.so obscure sha512
password        optional                        pam_plesk.so try_first_pass
# here's the fallback if no module succeeds
password        requisite                       pam_deny.so

I'll tell you why. You see that try_first_pass option after pam_plesk? It means that if this particular module is being run after a different one, one that already asked for the user's password, then it should try to reuse that password instead of asking again. However since pam_plesk runs first, there's no already-entered password to try, so you get the first two prompts. And then pam_unix runs, and it doesn't have try_first_pass either, so you get the other two prompts.

Alternatively you could try adding try_first_pass to the pam_unix line.

Make a backup of the common-passwd file, just in case, so you can rever the changes if they do not work. I don't have access to Plesk so I cannot test the suggested changes myself.

share|improve this answer
For being a pam amateur, you understand it well enough. Everything you said is correct :-) –  Patrick Mar 18 '12 at 19:44
add comment

Your Answer


