PWQUALITY.CONF(5)

💖 PWQUALITY.CONF(5) 💖

okay bestie, welcome to the File Formats Manual section of the universe, where we talk about pwquality.conf — literally the glow-up manual for your system's password rules. pull up a chair, grab a strawberry 🍓, and let's get into it.

---

✨ NAME ✨

pwquality.conf — the configuration file for the libpwquality library. it's giving "boss of all the password rules" energy. 👑

---

🌸 SYNOPSIS 🌸

/etc/security/pwquality.conf

/etc/security/pwquality.conf.d/*.conf

two paths, both iconic, both doing their own little thing. 💅

---

🦋 DESCRIPTION 🦋

so pwquality.conf is how you configure the default password quality requirements for the system passwords. the libpwquality library reads this file, and so do all the utilities that use that library for checking and generating passwords. no cap, this is the source of truth. 🔥

the file format is very simple: it's name = value, with comments allowed and starting with the # character. whitespace at the beginning of the line, at the end of the line, and around the = sign is all ignored. we don't care. it's not that deep. ✨

also, before you even get to the main file, the libpwquality library first reads all the *.conf files from the /etc/security/pwquality.conf.d directory, in ASCII sorted order. and if the same setting shows up more than once, the values get overridden in the order the files are parsed. last one to speak wins, fr fr. 🎀

---

🎀 OPTIONS 🎀

here are all the possible options you can put in the file, bestie. every single one. don't skip any. 👑

• difok — the number of characters in the new password that must not be present in the old password. (default 1)

the special value of 0 disables all the checks of similarity between the new password and the old password — except for the new password being exactly the same as the old one, because that one still gets caught. 💀

• minlen — the minimum acceptable size for the new password (plus one if credits are not disabled, which is the default). (See pam_pwquality(8).) cannot be set to a value lower than 6. (default 8)
• dcredit — the maximum credit for having digits in the new password. if it's less than 0, then it's the minimum number of digits in the new password. (default 0)
• ucredit — the maximum credit for having uppercase characters in the new password. if it's less than 0, then it's the minimum number of uppercase characters in the new password. (default 0)
• lcredit — the maximum credit for having lowercase characters in the new password. if it's less than 0, then it's the minimum number of lowercase characters in the new password. (default 0)
• ocredit — the maximum credit for having other characters in the new password. if it's less than 0, then it's the minimum number of other characters in the new password. (default 0)
• minclass — the minimum number of required classes of characters for the new password (digits, uppercase, lowercase, others). (default 0)
• maxrepeat — the maximum number of allowed same consecutive characters in the new password. the check is disabled if the value is 0. (default 0)
• maxsequence — the maximum length of monotonic character sequences in the new password. examples of such a sequence are '12345' or 'fedcb'. note that most such passwords will not pass the simplicity check unless the sequence is only a minor part of the password. the check is disabled if the value is 0. (default 0)
• maxclassrepeat — the maximum number of allowed consecutive characters of the same class in the new password. the check is disabled if the value is 0. (default 0)
• gecoscheck — if nonzero, check whether the words longer than 3 characters from the GECOS field of the user's passwd(5) entry are contained in the new password. the check is disabled if the value is 0. (default 0)
• dictcheck — if nonzero, check whether the password (with possible modifications) matches a word in a dictionary. currently the dictionary check is performed using the cracklib library. (default 1)
• usercheck=N — if nonzero, check whether the password (with possible modifications) contains the user name in some form. it is not performed for user names shorter than 3 characters. (default 1)
• usersubstr=N — if greater than 3 (because of the minimum length in usercheck), check whether the password contains a substring of at least N length in some form. (default 0)
• enforcing=N — if nonzero, reject the password if it fails the checks; otherwise just print the warning. this setting applies only to the pam_pwquality module and possibly other applications that explicitly change their behavior based on it. it does not affect pwmake(1) and pwscore(1). (default 1)
• badwords — a space separated list of words that must not be contained in the password. these are additional words on top of the cracklib dictionary check. this setting can also be used by applications to emulate the gecos check for user accounts that are not created yet. 🫶
• dictpath — the path to the cracklib dictionaries. the default is to use the cracklib default. 📁
• retry=N — prompt the user at most N times before returning with an error. the default is 1.
• enforce_for_root — the module will return an error on a failed check even if the user changing the password is root. this option is off by default, which means that only the message about the failed check is printed, but root can change the password anyway. note that root is not asked for an old password, so the checks that compare the old and new password are not performed. 👑
• local_users_only — the module will not test the password quality for users that are not present in the /etc/passwd file. the module still asks for the password so the following modules in the stack can use the use_authtok option. this option is off by default.

not me listing all twenty of these for you. yes bestie, all of them. every flag. periodt. 💅

---

🌈 SEE ALSO 🌈

pwscore(1), pwmake(1), pam_pwquality(8)

go read those too, iykyk. 🧚

---

💜 AUTHORS 💜

Tomas Mraz <tmraz@redhat.com>

---

and that's the whole vibe check, bestie. this page came to you courtesy of Red Hat, Inc., dated 2020-08-03, and it's the pwquality.conf(5) manual — iconic, timeless, and honestly? it ate. ✨👑💖 no cap, now go set some good password rules. slay. 🦋🌸