Make the cracklib check optional - on by default.

2 files changed, 17 insertions, 0 deletions

diff --git a/doc/man/pam_pwquality.8 b/doc/man/pam_pwquality.8
index b1f35e3..31ab6d4 100644
--- a/doc/man/pam_pwquality.8
+++ b/doc/man/pam_pwquality.8
@@ -250,6 +250,16 @@ field of the user are contained in the new password\&.
 The default is 0 which means that this check is disabled\&.
 .RE
 .PP
+\fBdictcheck=\fR\fB\fIN\fR\fR
+.RS 4
+If nonzero, check whether the password (with possible modifications)
+matches a word in a dictionary\&. Currently the dictionary check is performed
+using the
+\fBcracklib\fR
+library\&.
+The default is 1 which means that this check is enabled\&.
+.RE
+.PP
 \fBbadwords=\fR\fB\fI<list of words>\fR\fR
 .RS 4
 The words more than 3 characters long from this space separated list are
diff --git a/doc/man/pwquality.conf.5 b/doc/man/pwquality.conf.5
index a2d2d70..7315e1c 100644
--- a/doc/man/pwquality.conf.5
+++ b/doc/man/pwquality.conf.5
@@ -99,6 +99,13 @@ field of the user's passwd entry are contained in the new password.
 The check is disabled if the value is 0. (default 0)
 .RE
 .PP
+\fBdictcheck\fR
+.RS 4
+If nonzero, check whether the password (with possible modifications)
+matches a word in a dictionary. Currently the dictionary check is performed
+using the cracklib library. (default 1)
+.RE
+.PP
 \fBbadwords\fR
 .RS 4
 Space separated list of words that must not be contained in the password. These