linux - pam_cracklib not seeing old password -

i have enabled linux pam (version 1.1.4) , cracklib (version 2.8.22) , things working fine. password complexity specified via pam configuration file being adhered (upper/lower case, digits, etc) 'difok' not being adhered to. no matter set option to, pam_cracklib let password through (provided meets other complexity requirements i've specified).

long story short had modify linux pam cracklib add debug , found out pam_cracklib fails able retrieve old password. thinks string null naturally there nothing compare new password to.

yet when user changes own password, correctly authenticating current (what become old) password pam_unix correctly seeing old password. time gets down pam_cracklib line of pam configuration password appears have been wiped out somehow.

i'm pulling hair out trying figure out how/where/why happening.

here relevant password lines in pam configuration file:

password        requisite       pam_cracklib.so debug   reject_username\     minlen=6        ucredit=-1      lcredit=-1      difok=4 maxrepeat=2 password        required        pam_unix.so     debug   md5     shadow 

---

by way: being done programatically through front end application. not can done interactively in environment.

does have ideas on this?

hashed versions of old passwords stored in

/etc/security/opasswd

so check perms on file should read:

-rw-------.

also (and here crux of issue think) have ad remember field pam_unix module:

pam_unix.so try_first_pass remember=3 use_authtok null debug   md5     shadow