我在 Ubuntu 20.04 服务器上运行，并尝试使用命令更改当前用户的密码passwd。这是我得到的输出：
Changing password for ubuntu.
Current password:
New password:
Retype new password:
Password has been already used. Choose another.
passwd: Have exhausted maximum number of retries for service
passwd: password unchanged
但是密码已更改。我现在用新密码登录。为什么会发生这种情况？如何让命令的输出反映发生了什么？
看到输出后，我尝试使用旧密码登录，但被拒绝。新密码是正确的。
这是/etc/pam.d/common-password文件：
# /etc/pam.d/common-password - password-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define the services to be
# used to change user passwords. The default is pam_unix.
# Explanation of pam_unix options:
#
# The "sha512" option enables salted SHA512 passwords. Without this option,
# the default is Unix crypt. Prior releases used the option "md5".
#
# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
# login.defs.
#
# See the pam_unix manpage for other options.
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules. See
# pam-auth-update(8) for details.
# here are the per-package modules (the "Primary" block)
password requisite pam_pwquality.so retry=3
password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512
# here's the fallback if no module succeeds
password requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password required pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config
password required pam_pwhistory.so remember=5
答案1
pam_pwhistory.so是 PAM 模块，所以pam_pwquality.so，pam_unix.so和别的。
当堆叠在文件中时/etc/pam.d/common-password，它们按照堆叠的相同顺序被调用...因此，分解您案例中发生的事情（即按照你堆叠这些模块的顺序)：
首先，您的密码将通过以下方式评估其质量：
password requisite pam_pwquality.so retry=3
如果通过，则更改为：
password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512
因此，如您所见，此时您的新密码已被接受并设置（pam_unix.so是更改密码的模块) 而不检查您的用户密码历史记录。
后来，这个模块是什么：
password required pam_pwhistory.so remember=5
所做的和导致的只是打印：
Password has been already used. Choose another.
并passwd根据最后调用的模块的状态失败退出：
passwd: Have exhausted maximum number of retries for service
passwd: password unchanged
当为时已晚时。
为了解决这个问题，请按正确的顺序堆叠 PAM 模块，以产生您期望的结果，即如下所示：
# /etc/pam.d/common-password - password-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define the services to be
# used to change user passwords. The default is pam_unix.
# Explanation of pam_unix options:
#
# The "sha512" option enables salted SHA512 passwords. Without this option,
# the default is Unix crypt. Prior releases used the option "md5".
#
# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
# login.defs.
#
# See the pam_unix manpage for other options.
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules. See
# pam-auth-update(8) for details.
# here are the per-package modules (the "Primary" block)
password requisite pam_pwquality.so retry=3
password required pam_pwhistory.so remember=5 use_authtok
password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512
# here's the fallback if no module succeeds
password requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password required pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config
还要注意，增加了一个use_authtok选项以防止模块提示输入密码，而是使用前一个堆叠模块的密码...如果您必须使用之前的另一个模块，请使用该选项pam_pwquality.so，否则不应使用该选项。