Page MenuHomeVyOS Platform

Cracklib data is missing from the image which makes it impossible to run password complexity checks
Closed, ResolvedPublicBUG

Description

To reproduce, update the system image to the latest and add some new user

vyos@r14# set system login user one authentication plaintext-password 12345
[edit]
vyos@r14# commit
[ system login ]
Traceback (most recent call last):
  File "/usr/libexec/vyos/services/vyos-configd", line 144, in run_script
    script.verify(c)
  File "/usr/libexec/vyos//conf_mode/system_login.py", line 164, in verify
    result = evaluate_strength(plaintext_password)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/vyos/utils/auth.py", line 57, in evaluate_strength
    cracklib.FascistCheck(passwd)
FileNotFoundError: [Errno 2] No such file or directory: '/var/cache/cracklib/cracklib_dict.pwd'

[[system login]] failed
Commit failed
[edit]
vyos@r14#

The bug was added after merging password complexity https://github.com/vyos/vyos-1x/pull/4390
It cannot find cache.

vyos@r14# ls /var/cache/cracklib
ls: cannot access '/var/cache/cracklib': No such file or directory
[edit]
vyos@r14# 
[edit]
vyos@r14# ls /var/cache/
containers  debconf  private
[edit]
vyos@r14#

It seems not affected on new installed system, but only if you upgrade a system,

It should be reverted or fixed,

Details

Version
VyOS 2025.03.23-0020-rolling
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Event Timeline

Viacheslav triaged this task as Urgent! priority.
Viacheslav updated the task description. (Show Details)
Viacheslav changed the task status from Open to In progress.Mar 24 2025, 11:45 AM
Viacheslav assigned this task to oniko94.
Viacheslav moved this task from Need Triage to Completed on the VyOS Rolling board.
dmbaturin renamed this task from Impossible to create users to Cracklib data is missing from the image which makes it impossible to run password complexity checks.Mar 18 2026, 2:45 PM
dmbaturin changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.