PASSWDQC(8)             OpenBSD System Manager's Manual            PASSWDQC(8)

NAME
     passwdqc - Password quality checker

SYNOPSIS
     passwdqc [-1 length] [-2 length] [-3 length] [-4 length] [-p length] [-w
              words] [-s length]

DESCRIPTION
     passwdqc is intended to be used by passwd(1) as a plug-in password check-
     er to provide strong password complexity checks.

     To enable passwdqc as a password checker, it must be added to the system
     login.conf(5) using the passwordcheck key.  For example:

           default:\
               :passwordcheck=/usr/local/libexec/passwdqc -2 16 -wdisable:\
               ...

     This program is not intended to be invoked by the user, but it may be
     used by other programs that require strong password checking.  passwdqc
     should be run with the privileges of the user whose password is to be
     checked, as it looks up information using the current uid.

     passwdqc accepts a single password on standard input and returns a zero
     exit status if the password meets the complexity requirements.  passwdqc
     will return an error message and a non-zero exit status on error, or if
     the password is deemed to be too weak.

     The options are as follows:

     -1      Specify the minimum length for password consisting entirely of
             characters from one class.  The classes are lower-case letters,
             upper-case letters, digits and other characters.  Alternately the
             word ``disable'' may be used to disable passwords of this type.
             The default is ``disable''.

     -2      Specify the minimim length for passwords with characters from two
             classes.  The default is ``24''.

     -3      Specify the minimim length for passwords with characters from
             three classes.  The default is ``8''.

     -2      Specify the minimim length for passwords with characters from
             four classes.  The default is ``7''.

     -p      Specify the minimim length for passphrases.  Passphrases a words
             separated by whitespace.  See also the -w option.  The default is
             ``12''.

     -w      Specify the minimum number of words in a passphrase or
             ``disable'' to disable special treatment for passphrases.

     -s      Specifies the number of characters the password must have in com-
             mon with another string (e.g. a dictionary word or part of the
             users GECOS information) for the password to be considered to be
             "based on" that string.  The default is ``4''.

SEE ALSO
     passwd(1), login.conf(5),

AUTHORS
     Damien Miller <djm@openbsd.org> using the libpasswdqc code from
     Solar Designer <solar@openwall.com>

OpenBSD 4.7                      Jan 17, 2005                                1
