diff --git a/.etckeeper b/.etckeeper
index 6584d1a3..e299e8b6 100755
--- a/.etckeeper
+++ b/.etckeeper
@@ -418,6 +418,8 @@ maybe chmod 0644 'console-setup/compose.KOI8-U.inc'
 maybe chmod 0644 'console-setup/compose.TIS-620.inc'
 maybe chmod 0644 'console-setup/compose.VISCII.inc'
 maybe chmod 0644 'console-setup/remap.inc'
+maybe chmod 0755 'cracklib'
+maybe chmod 0644 'cracklib/cracklib.conf'
 maybe chmod 0755 'cron.d'
 maybe chmod 0644 'cron.d/.placeholder'
 maybe chmod 0644 'cron.d/amavisd-new'
@@ -429,6 +431,7 @@ maybe chmod 0644 'cron.daily/.placeholder'
 maybe chmod 0755 'cron.daily/00logwatch'
 maybe chmod 0755 'cron.daily/apt-compat'
 maybe chmod 0755 'cron.daily/chkrootkit'
+maybe chmod 0755 'cron.daily/cracklib-runtime'
 maybe chmod 0755 'cron.daily/dpkg'
 maybe chmod 0755 'cron.daily/etckeeper'
 maybe chmod 0755 'cron.daily/logrotate'
@@ -4110,6 +4113,7 @@ maybe chmod 0755 'security/namespace.d'
 maybe chmod 0755 'security/namespace.init'
 maybe chmod 0600 'security/opasswd'
 maybe chmod 0644 'security/pam_env.conf'
+maybe chmod 0644 'security/pwquality.conf'
 maybe chmod 0644 'security/sepermit.conf'
 maybe chmod 0644 'security/time.conf'
 maybe chmod 0644 'security/user_map.conf'
diff --git a/cracklib/cracklib.conf b/cracklib/cracklib.conf
new file mode 100644
index 00000000..533a5c40
--- /dev/null
+++ b/cracklib/cracklib.conf
@@ -0,0 +1,60 @@
+# copyright:
+#   Copyright (C) 1998, 1999 Jean Pierre LeJacq <jplejacq@quoininc.com>
+#   Modified 2003 by Martin Pitt <martin@piware.de>
+#
+#   Distributed under the GNU GENERAL PUBLIC LICENSE.
+#
+# description:
+#   Host configuration of cracklib.
+#
+#   Defines location of database used by cracklib as well as files
+#   used to create this database.  The database location,
+#   cracklib_dictpath, is compiled into the utility programs that are
+#   part of the cracklib-runtime package and should not be modified.
+#   But you should definitely add additional entries to
+#   cracklib_dictpath_src.  The entries are separated by spaces and
+#   should be the fully qualified path to a file of words that
+#   passwords should not match.  The files may optionally be compressed
+#   with gzip.
+#
+#   The current configuration supports both the fsstnd 1.2 and fhs 2.0 
+#   standard location for dictionaries.
+#
+# format:
+#   posix shell syntax.
+#
+# reference:
+#   1. http://www.pathname.com/fhs/2.0/fhs-toc.html
+#   2. http://www.pathname.com/fhs/1.2/fsstnd-toc.html
+
+
+# database (do not modify):
+  readonly cracklib_dictpath="/var/cache/cracklib/cracklib_dict"
+
+
+# database sources:
+  cracklib_dictpath_src=""
+
+  if [ -r "/usr/share/dict/cracklib" ]
+  then
+    cracklib_dictpath_src="${cracklib_dictpath_src} /usr/share/dict/cracklib"
+  fi
+
+  if [ -r "/usr/local/share/dict/cracklib" ]
+  then
+    cracklib_dictpath_src="${cracklib_dictpath_src} /usr/local/share/dict/cracklib"
+  fi
+
+  for i in /usr/share/dict /usr/dict /usr/local/share/dict /usr/local/dict
+  do
+    if [ -d $i ]
+    then
+      for file in $(find $i -type f -print | LC_ALL=C sort)
+      do
+        if $(file -z -b ${file} | grep -q "text")
+        then
+          cracklib_dictpath_src="${cracklib_dictpath_src} ${file}"
+        fi
+      done
+    fi
+  done
diff --git a/cron.daily/cracklib-runtime b/cron.daily/cracklib-runtime
new file mode 100755
index 00000000..e702c1b7
--- /dev/null
+++ b/cron.daily/cracklib-runtime
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+set -e
+
+if [ -x /usr/sbin/update-cracklib -a -r /etc/cracklib/cracklib.conf ]
+then
+    status="$(/usr/sbin/update-cracklib)"
+    if [ -n "${status}" ]
+    then
+        /usr/bin/logger -p cron.info -t cracklib "updated dictionary (read/written words: ${status})."
+    else
+        /usr/bin/logger -p cron.info -t cracklib "no dictionary update necessary."
+    fi
+fi
+
+exit 0
diff --git a/pam.d/common-password b/pam.d/common-password
index 6fa93461..d86c9d32 100644
--- a/pam.d/common-password
+++ b/pam.d/common-password
@@ -22,7 +22,8 @@
 # pam-auth-update(8) for details.
 
 # here are the per-package modules (the "Primary" block)
-password	[success=1 default=ignore]	pam_unix.so obscure yescrypt
+password	requisite			pam_pwquality.so retry=3
+password	[success=1 default=ignore]	pam_unix.so obscure use_authtok try_first_pass yescrypt
 # here's the fallback if no module succeeds
 password	requisite			pam_deny.so
 # prime the stack with a positive return value if there isn't one already;
diff --git a/security/pwquality.conf b/security/pwquality.conf
new file mode 100644
index 00000000..63eb315d
--- /dev/null
+++ b/security/pwquality.conf
@@ -0,0 +1,79 @@
+# Configuration for systemwide password quality limits
+# Defaults:
+#
+# Number of characters in the new password that must not be present in the
+# old password.
+# difok = 1
+#
+# Minimum acceptable size for the new password (plus one if
+# credits are not disabled which is the default). (See pam_cracklib manual.)
+# Cannot be set to lower value than 6.
+# minlen = 8
+#
+# The maximum credit for having digits in the new password. If less than 0
+# it is the minimum number of digits in the new password.
+# dcredit = 0
+#
+# The maximum credit for having uppercase characters in the new password.
+# If less than 0 it is the minimum number of uppercase characters in the new
+# password.
+# ucredit = 0
+#
+# The maximum credit for having lowercase characters in the new password.
+# If less than 0 it is the minimum number of lowercase characters in the new
+# password.
+# lcredit = 0
+#
+# The maximum credit for having other characters in the new password.
+# If less than 0 it is the minimum number of other characters in the new
+# password.
+# ocredit = 0
+#
+# The minimum number of required classes of characters for the new
+# password (digits, uppercase, lowercase, others).
+# minclass = 0
+#
+# The maximum number of allowed consecutive same characters in the new password.
+# The check is disabled if the value is 0.
+# maxrepeat = 0
+#
+# The maximum number of allowed consecutive characters of the same class in the
+# new password.
+# The check is disabled if the value is 0.
+# maxclassrepeat = 0
+#
+# Whether to check for the words from the passwd entry GECOS string of the user.
+# The check is enabled if the value is not 0.
+# gecoscheck = 0
+#
+# Whether to check for the words from the cracklib dictionary.
+# The check is enabled if the value is not 0.
+# dictcheck = 1
+#
+# Whether to check if it contains the user name in some form.
+# The check is enabled if the value is not 0.
+# usercheck = 1
+#
+# Length of substrings from the username to check for in the password
+# The check is enabled if the value is greater than 0 and usercheck is enabled.
+# usersubstr = 0
+#
+# Whether the check is enforced by the PAM module and possibly other
+# applications.
+# The new password is rejected if it fails the check and the value is not 0.
+# enforcing = 1
+#
+# Path to the cracklib dictionaries. Default is to use the cracklib default.
+# dictpath =
+#
+# Prompt user at most N times before returning with error. The default is 1.
+# retry = 3
+#
+# Enforces pwquality checks on the root user password.
+# Enabled if the option is present.
+# enforce_for_root
+#
+# Skip testing the password quality for users that are not present in the
+# /etc/passwd file.
+# Enabled if the option is present.
+# local_users_only