NAME

       pwquality.conf - configuration for the libpwquality library

SYNOPSIS

       /etc/security/pwquality.conf

       /etc/security/pwquality.conf.d/*.conf

DESCRIPTION

       pwquality.conf provides a way to configure the default password quality requirements for the system
       passwords. This file is read by the libpwquality library and utilities that use this library for checking
       and generating passwords.

       The file has a very simple name = value format with possible comments starting with "#" character. The
       whitespace at the beginning of line, end of line, and around the "=" sign is ignored.

       The libpwquality library also first reads all *.conf files from the /etc/security/pwquality.conf.d
       directory in ASCII sorted order. The values of the same settings are overriden in the order the files are
       parsed.

OPTIONS

       The possible options in the file are:

       difok
           Number of characters in the new password that must not be present in the old password. (default 1)

       minlen
           Minimum  acceptable  size  for  the  new  password (plus one if credits are not disabled which is the
           default). (See pam_pwquality(8).)  Cannot be set to lower value than 6. (default 8)

       dcredit
           The maximum credit for having digits in the new password. If less than 0 it is the minimum number  of
           digits in the new password. (default 0)

       ucredit
           The  maximum  credit  for  having uppercase characters in the new password.  If less than 0 it is the
           minimum number of uppercase characters in the new password. (default 0)

       lcredit
           The maximum credit for having lowercase characters in the new password.  If less than  0  it  is  the
           minimum number of lowercase characters in the new password. (default 0)

       ocredit
           The maximum credit for having other characters in the new password.  If less than 0 it is the minimum
           number of other characters in the new password. (default 0)

       minclass
           The  minimum  number  of  required  classes  of  characters  for the new password (digits, uppercase,
           lowercase, others). (default 0)

       maxrepeat
           The maximum number of allowed same consecutive characters in the new password.  The check is disabled
           if the value is 0. (default 0)

       maxsequence
           The maximum length of monotonic character sequences in the new password.  Examples of  such  sequence
           are  '12345'  or 'fedcb'. Note that most such passwords will not pass the simplicity check unless the
           sequence is only a minor part of the password.  The check is disabled if the value is 0. (default 0)

       maxclassrepeat
           The maximum number of allowed consecutive characters of the same class  in  the  new  password.   The
           check is disabled if the value is 0. (default 0)

       gecoscheck
           If  nonzero,  check  whether  the  words  longer than 3 characters from the GECOS field of the user's
           passwd(5) entry are contained in the new password.  The check is disabled if the value is 0. (default
           0)

       dictcheck
           If nonzero, check whether the password (with possible modifications) matches a word in a  dictionary.
           Currently the dictionary check is performed using the cracklib library. (default 1)

       badwords
           Space  separated list of words that must not be contained in the password. These are additional words
           to the cracklib dictionary check. This setting can be also used by applications to emulate the  gecos
           check for user accounts that are not created yet.

       dictpath
           Path to the cracklib dictionaries. Default is to use the cracklib default.

SEE ALSO

       pwscore(1), pwmake(1), pam_pwquality(8)

AUTHORS

       Tomas Mraz <tmraz@redhat.com>

Red Hat, Inc.                                      2015-07-22                                  PWQUALITY.CONF(5)