Ensure PAM Enforces Password Requirements - Minimum Digit Characters
Sets pwquality dcredit = -1 so every new password must contain at least one digit, enforced by PAM at password-change time.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Password strength measures how well a password resists guessing and brute-force attacks, and complexity is a key factor: the larger the character space, the more combinations an attacker must test. A negative dcredit value forces at least one digit in every password, enlarging that search space and making password-guessing attacks materially harder.
What Pavois checks
Pavois reads the effective pwquality configuration by grepping /etc/security/pwquality.conf and every drop-in under /etc/security/pwquality.conf.d/, taking the last dcredit= value (the one that actually wins) and requiring it to be <= -1. Resolving the merged drop-in order is what file-by-file checks miss, a later drop-in can silently override the main file.
describe command('v=$(grep -rh \'^[[:space:]]*dcredit[[:space:]]*=\' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/ 2>/dev/null | tail -1 | grep -oE \'[-]?[0-9]+\'); { [ -n "$v" ] && [ "$v" -le -1 ] && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -rh '^[[:space:]]*dcredit' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/ | tail -1, the effective line should read dcredit = -1 (or any value <= -1). Then test live: as a normal user run passwd and try a digit-free password; it must be rejected for not containing a digit.
Inspect & investigate
PAM password-change events and pwquality rejections are logged to /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL); look for pam_pwquality / pam_unix(passwd:chauthtok) entries, or use journalctl -t passwd. The effective config is confirmed by reading the merged pwquality.conf.d drop-ins.
Remediation
pavois harden apply writes the keyval setting dcredit = -1 into the drop-in /etc/security/pwquality.conf.d/99-Pavois.conf, which takes precedence over the distro defaults. No service restart is needed, PAM re-reads pwquality at the next passwd / authentication.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/security/pwquality.conf.d/99-pavois.conf |
|---|---|
| key | dcredit |
| resource | keyval |
| value | -1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
This rule only affects new or changed passwords; existing passwords keep working until their next change, so there is no lockout risk on apply. Users will be forced to include a digit the next time they set a password, which can surprise automated provisioning that sets digit-free passwords. Coordinate with any tooling that generates credentials, and ensure your password generator emits at least one digit before enforcing this fleet-wide.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R31 | direct | 2.0 | high |
| CIS | 5.3.3.2.3, 8.3.6 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), IA-5(1)(a), IA-5(4), IA-5(c) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 8.3.6 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-611020, UBTU-24-400280 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.