# /etc/security/pwquality.conf — libpwquality configuration
# InterGenOS T0-4-B PAM-side closure (operator-greenlit RHEL 9 baseline 2026-05-19).
# Source-of-truth for password complexity policy.

# Minimum password length.
minlen = 12

# Credit deduction per character class. Negative values are MINIMUMS:
# require at least this many characters of the class.
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1

# Maximum number of consecutive identical characters.
maxrepeat = 3

# Reject passwords containing the username.
usercheck = 1

# Apply the policy to root as well as regular users.
enforce_for_root
