PAM_PWQUALITY(8) Linux-PAM Manual PAM_PWQUALITY(8) (NAME) pam_pwquality - PAM (SYNOPSIS) pam_pwquality.so [...] (DESCRIPTION) password . pam_cracklib . . ( ). . : (Palindrome) ( ) (Case Change Only) (Similar) difok ( ) . (Simple) : minlen maxclassrepeat dcredit ucredit lcredit ocredit. . (Rotated) (Same consecutive characters) . (Too long monotonic character sequence) () . (Contains user name) . (Dictionary check) Cracklib . /etc/security/pwquality.conf . . (OPTIONS) debug syslog(3) ( ). authtok_type=XXX : "New UNIX password: " "Retype UNIX password: ". UNIX . retry=N N . 1 . difok=N 1 . 0 . minlen=N ( ). (other upper lower digit) ( + ) . 8 . Cracklib : " " 4 (6) minlen . dcredit=N (N >= 0) . N + minlen . dcredit 0 . (N < 0) . ucredit=N (N >= 0) . N + minlen . ucredit 0 . (N < 0) . lcredit=N (N >= 0) . N + minlen . lcredit 0 . (N < 0) . ocredit=N (N >= 0) . N + minlen . ocredit 0 . (N < 0) . minclass=N . . credit N . . maxrepeat=N N . 0 . maxsequence=N N . 0 . '12345' 'fedcb' . . maxclassrepeat=N N . 0 . gecoscheck=N GECOS passwd(5) . 0 . dictcheck=N ( ) . cracklib . 1 . usercheck=N ( ) . 1 . . usersubstr=N ( usercheck) N . 0 . enforcing=N . 1 ( ) . badwords= . . dictpath=/path/to/dict cracklib . enforce_for_root root . root . root . local_users_only /etc/passwd . use_authtok . . use_authtok password . (MODULE TYPES PROVIDED) password . (RETURN VALUES) PAM_SUCCESS . PAM_AUTHTOK_ERR . PAM_AUTHTOK_RECOVERY_ERR . use_authtok . PAM_SERVICE_ERR . (EXAMPLES) password pam_unix(8) . # # These lines stack two password type modules. In this example the # user is given 3 opportunities to enter a strong password. The # "use_authtok" argument ensures that the pam_unix module does not # prompt for a password, but instead uses the one provided by # pam_pwquality. # password required pam_pwquality.so retry=3 password required pam_unix.so use_authtok sha256 : # # These lines allow modern systems to support passwords of at least 14 # bytes with extra credit of 2 for digits and 2 for others the new # password must have at least three bytes that are not present in the # old password # password required pam_pwquality.so \ difok=3 minlen=15 dcredit=2 ocredit=2 password required pam_unix.so use_authtok nullok sha256 : # # These lines require the user to select a password with a minimum # length of 8 and with at least 1 digit number, 1 upper case letter, # and 1 other character # password required pam_pwquality.so \ dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8 password required pam_unix.so use_authtok nullok sha256 (SEE ALSO) pwscore(1), pwquality.conf(5), pam_pwquality(8), pam.conf(5), PAM(8) (AUTHORS) Tomas Mraz pam_cracklib: Cristian Gafton Red Hat, Inc. 2025-12-14 PAM_PWQUALITY(8)