PWQUALITY.CONF(5)PWQUALITY.CONF(5)NAMEpwquality.conf - configuration for the libpwquality library
SYNOPSIS
/etc/security/pwquality.conf
DESCRIPTIONpwquality.conf provides a way to configure the default password quality
requirements for the system passwords. This file is read by the libp‐
wquality library and utilities that use this library for checking and
generating passwords.
The file has a very simple name = value format with possible comments
starting with # character. The whitespace at the beginning of line, end
of line, and around the = sign is ignored.
OPTIONS
The possible options in the file are:
difok
Number of characters in the new password that must not be
present in the old password. (default 5)
minlen
Minimum acceptable size for the new password (plus one if cred‐
its are not disabled which is the default). (See pam_pwqual‐
ity(8).) Cannot be set to lower value than 6. (default 9)
dcredit
The maximum credit for having digits in the new password. If
less than 0 it is the minimum number of digits in the new pass‐
word. (default 1)
ucredit
The maximum credit for having uppercase characters in the new
password. If less than 0 it is the minimum number of uppercase
characters in the new password. (default 1)
lcredit
The maximum credit for having lowercase characters in the new
password. If less than 0 it is the minimum number of lowercase
characters in the new password. (default 1)
ocredit
The maximum credit for having other characters in the new pass‐
word. If less than 0 it is the minimum number of other charac‐
ters in the new password. (default 1)
minclass
The minimum number of required classes of characters for the
new password (digits, uppercase, lowercase, others). (default
0)
maxrepeat
The maximum number of allowed same consecutive characters in
the new password. The check is disabled if the value is 0.
(default 0)
maxsequence
The maximum length of monotonic character sequences in the new
password. Examples of such sequence are '12345' or 'fedcb'.
Note that most such passwords will not pass the simplicity
check unless the sequence is only a minor part of the password.
The check is disabled if the value is 0. (default 0)
maxclassrepeat
The maximum number of allowed consecutive characters of the
same class in the new password. The check is disabled if the
value is 0. (default 0)
gecoscheck
If nonzero, check whether the words longer than 3 characters
from the GECOS field of the user's passwd entry are contained
in the new password. The check is disabled if the value is 0.
(default 0)
badwords
Space separated list of words that must not be contained in the
password. These are additional words to the cracklib dictionary
check. This setting can be also used by applications to emulate
the gecos check for user accounts that are not created yet.
dictpath
Path to the cracklib dictionaries. Default is to use the crack‐
lib default.
SEE ALSOpwscore(1), pwmake(1), pam_pwquality(8)AUTHORS
Tomas Mraz <tmraz@redhat.com>
Red Hat, Inc. 10 Nov 2011 PWQUALITY.CONF(5)
