Users on Linux clients with pam_passwdqc.so pam module cannot change their password (4256121)

Users on Linux clients with pam_passwdqc.so pam module cannot change their password

Users on Linux clients cannot change their password if the system is using the pam_passwdqc.so PAM (Pluggable Authentication Module) module for password complexity.

This is caused the order of the password lines in the system-auth pam stack. The pam_vas3.so modules need to be above the pam_passwdqc.so modules.  

This is an example of the system-auth password stack which resolves the issue.

password        sufficient      pam_vas3.so
password        requisite       pam_vas3.so echo_return
password        requisite       pam_passwdqc.so min=disabled,disabled,11,9,8 max=40 enforce=users retry=6 random=0 ask_oldauthtok check_oldauthtok
password        required        pam_pwhistory.so remember=6 retry=3
password        sufficient      pam_unix.so md5 shadow nullok try_first_pass use_authtok
password        required        pam_deny.so