diff -Naru orig/etc/pam.d/common-password new/etc/pam.d/common-password
--- orig/etc/pam.d/common-password	2018-04-25 10:26:55.805688250 -0500
+++ new/etc/pam.d/common-password	2018-04-25 10:27:48.041686704 -0500
@@ -16,7 +16,8 @@
 # See the pam_unix manpage for other options.
 
 # here are the per-package modules (the "Primary" block)
-password	[success=1 default=ignore]	pam_unix.so obscure sha512
+password	requisite			pam_pwquality.so retry=3
+password	[success=1 default=ignore]	pam_unix.so obscure use_authok try_frist_pass sha512
 # here's the fallback if no module succeeds
 password	requisite			pam_deny.so
 # prime the stack with a positive return value if there isn't one already;