PAM: password policy and lockout

For the system to reject a weak password, a quality check — pwquality — is added to the password-change stack.

In the image the password is checked only by the pam_unix module with the obscure option: it catches the crude cases — a too-short password, a palindrome, a single case change. The eight-letter dictionary word password passes that check. The pwquality check knows more: a minimum length, a number of character classes, a dictionary. You turn it on with sudo pam-auth-update --enable pwquality — it adds the line pam_pwquality.so to common-password.

The check's rules live in /etc/security/pwquality.conf. The two main lines: minlen — the minimum password length, minclass — how many different character classes it must contain (lowercase, uppercase, digits, symbols). An empty file means the built-in values; you write your own rules as a line name = value.