# Prohibition on the use of compromised passwords
# Symptoms

Is it possible to set a list of passwords that are forbidden for system users to use?

Is it possible to prohibit compromised passwords?

# Solution

Yes, starting from version 6.0.x, it is possible to enable a check for passwords included in the list of compromised passwords and prohibit the use of such passwords.

:::caution
Large lists of passwords can cause a significant decrease in system performance. To minimize the load, it is recommended to use a combination of password security policy settings and a list of compromised passwords that formally meet the required complexity.
:::

To enable the check, follow these steps:

1.  Log in to the Swarmica server and upload the file with compromised passwords to the Swarmica installation folder (usually `/root/swarmica`), for example, `/root/swarmica/password_blacklist`. Each line in the file should contain one password.
2.  Create a backup copy of the `docker-compose.yml` file:
    ```shell
    cp docker-compose.yml{,.backup}
    ```
3.  Edit the `docker-compose.yml` file, adding the password file to the `volumes` section of the `django` container:
    ```yaml
    django:
      ...
      volumes:
        ...
        - ./password_blacklist:/swarmica/swarmica/password_blacklist:ro
        ...
    ```
4.  Edit the `.env` file, adding the `__password_blacklist` feature flag as a comma-separated value in the `FEATURES` variable and specifying the location of the password file in the `PASSWORD_BLACKLIST_PATH` variable:
    ```txt
    FEATURES=__password_blacklist,...
    ...
    PASSWORD_BLACKLIST_PATH=/swarmica/swarmica/password_blacklist
    ```
    :::caution
    The file path must be specified relative to the file system of the django container, i.e., the mount point of the file inside the container (what comes after `:` in the `volumes` section).
    :::
5.  Restart the services:
    ```shell
    docker compose down && docker compose up -d
    ```