# ISM password policy — predictable constructions
#
# Source: ACSC ISM OSCAL catalogue v2026.09.4
#   ism-1558  word-sequence composition constraints                   (all)
#
# The limbs of ism-1558 that a character-level rule can enforce: monotonic runs,
# repeated characters, and strings derived from the account itself. The word count
# is enforced by debian-13-pam-wordcount, and whether words were randomly selected
# is not something any available module can determine.
#
# These are predictability constraints, not character-class complexity
# requirements, so they do not conflict with ism-2080.
#
# Install to /etc/security/pwquality.conf.d/50-ism-predictability.conf

# maxrepeat blocks "aaaa...", maxsequence blocks "abcdefgh" / "12345678" runs.
maxrepeat = 3
maxsequence = 4

# Reject a passphrase containing the user's own name or login, which is neither
# random nor secret.
usercheck = 1
usersubstr = 4
gecoscheck = 1