pwquality.conf(5)

NAME

   pwquality.conf - configuration for the libpwquality library

SYNOPSIS

   /etc/security/pwquality.conf

   /etc/security/pwquality.conf.d/*.conf

DESCRIPTION

   pwquality.conf provides a way to configure the default password quality
   requirements for the system passwords. This file is read by the
   libpwquality library and utilities that use this library for checking
   and generating passwords.

   The file has a very simple name = value format with possible comments
   starting with "#" character. The whitespace at the beginning of line,
   end of line, and around the "=" sign is ignored.

   The libpwquality library also first reads all *.conf files from the
   /etc/security/pwquality.conf.d directory in ASCII sorted order. The
   values of the same settings are overriden in the order the files are
   parsed.

OPTIONS

   The possible options in the file are:

   difok
       Number of characters in the new password that must not be present
       in the old password. (default 1)

   minlen
       Minimum acceptable size for the new password (plus one if credits
       are not disabled which is the default). (See pam_pwquality(8).)
       Cannot be set to lower value than 6. (default 8)

   dcredit
       The maximum credit for having digits in the new password. If less
       than 0 it is the minimum number of digits in the new password.
       (default 0)

   ucredit
       The maximum credit for having uppercase characters in the new
       password.  If less than 0 it is the minimum number of uppercase
       characters in the new password. (default 0)

   lcredit
       The maximum credit for having lowercase characters in the new
       password.  If less than 0 it is the minimum number of lowercase
       characters in the new password. (default 0)

   ocredit
       The maximum credit for having other characters in the new password.
       If less than 0 it is the minimum number of other characters in the
       new password. (default 0)

   minclass
       The minimum number of required classes of characters for the new
       password (digits, uppercase, lowercase, others). (default 0)

   maxrepeat
       The maximum number of allowed same consecutive characters in the
       new password.  The check is disabled if the value is 0. (default 0)

   maxsequence
       The maximum length of monotonic character sequences in the new
       password.  Examples of such sequence are '12345' or 'fedcb'. Note
       that most such passwords will not pass the simplicity check unless
       the sequence is only a minor part of the password.  The check is
       disabled if the value is 0. (default 0)

   maxclassrepeat
       The maximum number of allowed consecutive characters of the same
       class in the new password.  The check is disabled if the value is
       0. (default 0)

   gecoscheck
       If nonzero, check whether the words longer than 3 characters from
       the GECOS field of the user's passwd(5) entry are contained in the
       new password.  The check is disabled if the value is 0. (default 0)

   dictcheck
       If nonzero, check whether the password (with possible
       modifications) matches a word in a dictionary. Currently the
       dictionary check is performed using the cracklib library. (default
       1)

   badwords
       Space separated list of words that must not be contained in the
       password. These are additional words to the cracklib dictionary
       check. This setting can be also used by applications to emulate the
       gecos check for user accounts that are not created yet.

   dictpath
       Path to the cracklib dictionaries. Default is to use the cracklib
       default.

SEE ALSO

   pwscore(1), pwmake(1), pam_pwquality(8)

AUTHORS

   Tomas Mraz <tmraz@redhat.com>

---

Free and Open Source Software