Verify pam_pwquality module is activated
Ensures pam_pwquality.so is present in the PAM password stack so new passwords are checked for strength (length, complexity, dictionary words).
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Strong passwords significantly increase the time and effort required for unauthorized access, improving overall system security. pam_pwquality is the module that enforces composition rules at password-set time; without it, users can choose trivially weak or dictionary passwords that fall instantly to guessing or cracking.
What Pavois checks
Pavois greps the effective PAM stack under /etc/pam.d/ for an active (non-commented) pam_pwquality.so line. The password stack is built from common-password and its @include chain, so reading the resolved files catches the case where the module is declared in a sample but absent from the path PAM actually applies, a gap a single-file scan misses.
describe command('grep -RqE \'^[^#]*\bpam_pwquality\\.so\b\' /etc/pam.d/ 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -rE '^[^#]*pam_pwquality\.so' /etc/pam.d/; an active password line should reference the module. Functionally, run passwd and try a weak password (e.g. abc), it should be rejected with a quality message.
Inspect & investigate
Password-change attempts and quality rejections are logged in /var/log/auth.log (Debian/Ubuntu). The module's policy is read from /etc/security/pwquality.conf.
Remediation
No automated remediation is wired for this rule, so it must be applied manually: install libpam-pwquality and add a password requisite pam_pwquality.so retry=3 line to /etc/pam.d/common-password (before pam_unix.so), typically via pam-auth-update, then set policy in /etc/security/pwquality.conf.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | apt-get install -y libpam-pwquality pam-auth-update --enable pwquality 2>/dev/null || pam-auth-update |
|---|---|
| reason | installs + enables a PAM module, review which password profile you want |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Adding pam_pwquality only affects password changes, not logins or sessions, but an overly strict policy can frustrate users or block password resets, and a malformed password line can break all password changes. Precautions: keep a root session open, start with reasonable settings (e.g. minlen, retry=3), test passwd on a throwaway user, and ensure the line precedes pam_unix.so.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.3.2.3 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.