# ISM password policy — minimum length, applicability S
#
# Source: ACSC ISM OSCAL catalogue v2026.09.4
#   ism-1557  single-factor passwords are a minimum of 17 characters  (S)
#
# This is a pure character count: debian-13-pwquality-no-complexity sets every
# credit to 0, so no character class can earn back a character against it. Without
# that component, credits could let a shorter password satisfy this minimum.
#
# Exactly one minimum may be live: pwquality.conf.d is read in ASCII sort order and
# a second minlen would silently win. The apply script removes the other two.
#
# Install to /etc/security/pwquality.conf.d/50-ism-minlen-s.conf

minlen = 17