← All rules
SOCLE-CLD-PKG-071// Packagesmediuminventory state

Install pam_pwquality Package

Ensures the libpwquality library (backing pam_pwquality for password-strength enforcement) is installed.

Checked against what is installed or registered, packages present/absent, account databases.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 2 standards

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

A complex password increases the time and resources required to compromise it. Password complexity, or strength, measures how well a password resists guessing and brute-force attacks. The libpwquality library (used by pam_pwquality) enforces password construction rules (length, character classes, dictionary checks) and is the prerequisite for limiting weak-password and brute-force risks. Without it installed, the PAM stack cannot enforce any of the configured complexity policies.

What Pavois checks

Pavois asks the package manager whether libpwquality is installed via the InSpec package resource (rpm -q libpwquality on RHEL, dpkg-query -W libpwquality on Ubuntu/Debian). Querying installed-package state directly confirms the module is present, rather than assuming it from pwquality.conf settings that have no effect if the library is missing.

describe package('libpam-pwquality') do
  it { should be_installed }
end

How to verify it is applied

Run rpm -q libpwquality (RHEL) or dpkg-query -W -f='${Status}\n' libpwquality (Ubuntu/Debian). The expected output is a versioned package name / install ok installed. You can test policy enforcement with pwscore <<< 'weak'.

Inspect & investigate

  • rpm -q libpwquality / dpkg-query -W libpwquality, confirms the package is installed.
  • journalctl -t passwd -t chpasswd, rejected weak passwords are logged here when pam_pwquality is active.
  • pwscore, interactively scores a candidate password against the policy.

Remediation

Pavois's harden plan declares a package resource for pam-pwquality with action install and applies it with pavois harden apply, which runs dnf install libpwquality (or apt-get install libpam-pwquality) under the hood. Configuring the actual complexity rules in pwquality.conf/the PAM stack is governed by separate password-policy controls.

Pavois applies this with its own harden engine, the plan below, not a shell script:

actioninstall
namelibpam-pwquality
resourcepackage
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Installing the library alone is non-disruptive, it does not change behavior until pam_pwquality is enabled in the PAM stack and policy is configured. The risk arises when enforcement is turned on: overly strict rules can frustrate password changes. Precaution: keep a root shell open, set realistic complexity values, and test a password change with passwd before relying on the new policy, to avoid blocking legitimate users.

Standards mapping

StandardReferenceTypeVersionConfidence
CIS5.3.1.3, 5.3.2.3directper OS, see the benchmark tablehigh
DISA STIGUBTU-22-215010, UBTU-24-100600directper OS STIG releasehigh

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references