# ISM password policy — enforcement base
#
# pam_pwquality itself, and the settings that decide whether any rule bites. It
# imposes no rule of its own: the rules live in components that own their own
# settings and depend on this one.
#
# Source: ACSC ISM OSCAL catalogue v2026.09.4
#   ism-2079  maximum length limits are not less than 64 characters   (all)
#   ism-2081  all ASCII printable characters are supported            (all)
#
# Both are satisfied by omission: pam_pwquality imposes no maximum length and no
# character-set restriction, so the effective ceiling is the PAM response buffer,
# well above the 64-character floor ism-2079 requires.
#
# Install to /etc/security/pwquality.conf.d/40-ism-base.conf. The 40- prefix sorts
# before the rule drop-ins, which is irrelevant to these keys but keeps the
# enforcement base visibly first.

# Enforce the policy rather than only warning, and apply it to root as well.
enforcing = 1
enforce_for_root

# Only evaluate local users; directory-sourced accounts are governed by the
# directory's own policy, which must be assessed separately.
local_users_only

retry = 3