# Begin /etc/pam.d/system-password
# pam_pwquality.so requisite: enforce complexity policy from /etc/security/
# pwquality.conf BEFORE pam_unix performs the actual password change.
# requisite (not required) so failure short-circuits with no fall-through.
password  requisite   pam_pwquality.so retry=3 enforce_for_root
password  required    pam_unix.so       yescrypt shadow use_authtok
# End /etc/pam.d/system-password
