diff --git a/config/includes.chroot/etc/login.defs b/config/includes.chroot/etc/login.defs
index 6638346..e20f543 100644
--- a/config/includes.chroot/etc/login.defs
+++ b/config/includes.chroot/etc/login.defs
@@ -93,6 +93,7 @@ TTYPERM		0600
 #
 ERASECHAR	0177
 KILLCHAR	025
+UMASK 077
 
 # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
 # home directories.
@@ -170,6 +171,8 @@ CHFN_RESTRICT		rwh
 # the PAM modules configuration.
 #
 ENCRYPT_METHOD YESCRYPT
+SHA_CRYPT_MIN_ROUNDS 8388608
+SHA_CRYPT_MAX_ROUNDS 8388608
 
 #
 # Should login be allowed if we can't cd to the home directory?