I am wondering how the password policy "your new password must differ at least n characters from your old password" works.
My understanding is that the OS never actually stores the old passwords themselves, but their hash codes instead. And there is no way of knowing in how many characters the two strings differ if you have only their hash codes.
Am I right in the guess that it can work only if the passwd program asks you explicitly at the same time also for your old password?
And is the consequence that if a root user changes someone else's password, the "number of different characters" policy simply cannot be applied here?
Best Answer
Such policies are usually implemented by applying them when asking for the old password.
Another option would be to brute-force the old one. When you input your new one, a modern computer has no problem to brute-force all passwords which differ by 2 characters from the new one. As far as I know this is not used in the normal authentication in typical linux distributions but possible some PAM modules implement this.
The usual approach for root changing passwords is to assume that the superuser know's what he's doing. The passwd program does not ask for the old password and allows you to override rules like a minimum length at your own risk.