Set Password Minimum Length in login.defs
Enforces a minimum password length of 15 characters via the PASS_MIN_LEN directive in /etc/login.defs.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Requiring a minimum password length makes password-cracking (brute-force and dictionary) attacks far harder by enlarging the search space an attacker must explore. Short passwords are trivially guessed offline once a hash leaks. Any benefit from an onerous length requirement must still be weighed against usability and support costs, but a 15-character floor is a widely accepted baseline.
What Pavois checks
Pavois reads the resolved PASS_MIN_LEN value from /etc/login.defs through the InSpec login_defs resource and asserts it is >= 15. This is the value useradd/passwd actually consult, so Pavois reports the effective policy rather than guessing from a comment or a stale documentation file.
describe login_defs do
its('PASS_MIN_LEN') { should cmp >= {'bp28'=>15,'nist'=>12}.fetch(input('pavois_standard', value: '_default'), 15) }
endHow to verify it is applied
Run grep '^PASS_MIN_LEN' /etc/login.defs. The expected output is PASS_MIN_LEN 15 (or a higher value).
Inspect & investigate
Password changes are recorded in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL). A rejected too-short password from passwd is logged there. Inspect the active value with grep PASS_MIN_LEN /etc/login.defs.
Remediation
No automated harden plan is shipped for this rule, so it must be applied manually: set PASS_MIN_LEN 15 in /etc/login.defs. Note that on modern systems pam_pwquality/pam_unix (the minlen option) is the authoritative length enforcer for interactive password changes; align both.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/login.defs |
|---|---|
| key | PASS_MIN_LEN |
| resource | conf_line |
| sep | space |
| value | 15 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A weak floor (e.g. the historical default of 5) lets users keep trivially crackable passwords, undermining every other authentication control. Before raising the value, communicate the new requirement to users and confirm pam_pwquality minlen matches, otherwise users may be confused when passwd rejects passwords accepted elsewhere. The change is non-disruptive: existing passwords keep working until next change, so there is no lockout risk.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R31 | direct | 2.0 | high |
| NIST | 3.5.7, CM-6(a), IA-5(1)(a), IA-5(f) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.