Passwords strength / RGPD

I would like the user to create a password with at least 17 or more characters (signs, chars, digits…)… I just see for the moment, we need to create a password with 4 chars…but we can enter 1234… I really don’t want that !
Is there a plan for a future version to add a menu in the administration where we could define how the password must be:
the frequency for a change (ex: must be changed 1 per month, quarter…), the minimum length, the rules (chars, digits, uppercase, lowercase, signs), max attempts to login…and to automatically lock the userid until the admin has checked it was not an attack…
Maybe a way to warn the admin someone tried to login with a wrong password, and the IP address used for the connection…with a possibility to ban the IP address after verification with the user…

Or are there already some hooks, exits, routins where we could add some own code for this feature and maybe some others…
thanks

Hi
About password change requirement I created a chron job to invalidate all user account with password older than 90 days.