I think that is what you are looking for.
There are defaults that can and are limiting.
That file should have comments in it if its a recent Linux distro.
And its PAM* that typically does all this stuff for you now.
*PAM == Pluggable Authentication Module (but does way more)