Install pam_pwquality Package
Ensures the libpwquality library (backing pam_pwquality for password-strength enforcement) is installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
A complex password increases the time and resources required to compromise it. Password complexity, or strength, measures how well a password resists guessing and brute-force attacks. The libpwquality library (used by pam_pwquality) enforces password construction rules (length, character classes, dictionary checks) and is the prerequisite for limiting weak-password and brute-force risks. Without it installed, the PAM stack cannot enforce any of the configured complexity policies.
What Pavois checks
Pavois asks the package manager whether libpwquality is installed via the InSpec package resource (rpm -q libpwquality on RHEL, dpkg-query -W libpwquality on Ubuntu/Debian). Querying installed-package state directly confirms the module is present, rather than assuming it from pwquality.conf settings that have no effect if the library is missing.
describe package('libpam-pwquality') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q libpwquality (RHEL) or dpkg-query -W -f='${Status}\n' libpwquality (Ubuntu/Debian). The expected output is a versioned package name / install ok installed. You can test policy enforcement with pwscore <<< 'weak'.
Inspect & investigate
rpm -q libpwquality/dpkg-query -W libpwquality, confirms the package is installed.journalctl -t passwd -t chpasswd, rejected weak passwords are logged here whenpam_pwqualityis active.pwscore, interactively scores a candidate password against the policy.
Remediation
Pavois's harden plan declares a package resource for pam-pwquality with action install and applies it with pavois harden apply, which runs dnf install libpwquality (or apt-get install libpam-pwquality) under the hood. Configuring the actual complexity rules in pwquality.conf/the PAM stack is governed by separate password-policy controls.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | libpam-pwquality |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing the library alone is non-disruptive, it does not change behavior until pam_pwquality is enabled in the PAM stack and policy is configured. The risk arises when enforcement is turned on: overly strict rules can frustrate password changes. Precaution: keep a root shell open, set realistic complexity values, and test a password change with passwd before relying on the new policy, to avoid blocking legitimate users.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.3.1.3, 5.3.2.3 | direct | per OS, see the benchmark table | high |
| DISA STIG | UBTU-22-215010, UBTU-24-100600 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.