There is a string in /etc/pam.d/system-auth-winbind installed by net-fs/samba-3* password required pam_cracklib.so retry=3 I think this should be optional with IUSE="cracklib" and have RDEPENDS="cracklib? ( sys-libs/cracklib )". Reproducible: Always