chpasswd can't change password with libpam-passwdqc enabled

[EOLE team]

Hello.

We are unable to change user password using chpasswd with libpam-passwdqc, it seems to miss detect old password:

    root@server:~# echo 'root:hearth=mirth-Double' | chpasswd
    […]
    Weak password: is the same as the old one.
    Try again.

    root@server:~# echo $?
    1

I tried the following to make sure the old password was not the same:

    root@server:~# echo 'root:foo' | chpasswd -c SHA512
    root@server:~# echo 'root:hearth=mirth-Double' | chpasswd
    […]
    Weak password: is the same as the old one.
    Try again.

    root@server:~# echo $?
    1

[EOLE team (eole-team)]

It may be due to the libpam-passwdqc configuration using ask_oldauthtok and similar=deny.

It was working fine on Bionic but fails with Focal.

[EOLE team (eole-team)]

The solution is to provide a dedicated pam configuration for chpasswd without the ask_oldauthtok option.

[EOLE team (eole-team)]

To reproduce:

    apt install libpam-passwdqc
    sed -i -e 's/\(pam_passwdqc.so\)/\1 ask_oldauthtok/' /etc/pam.d/common-password
    echo 'root:hearth=mirth-Double' | chpasswd