Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
Sets pwquality dictcheck = 1 so PAM rejects passwords based on dictionary words, preventing easily-guessable credentials.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Password strength measures resistance to guessing and brute-force attacks. Passwords built from dictionary words are dramatically weaker because attackers run dictionary and wordlist attacks first, they fall in seconds regardless of length. Enabling dictcheck makes pwquality reject such passwords at change time, closing one of the most common avenues of credential compromise.
What Pavois checks
Pavois reads the effective pwquality configuration by grepping /etc/security/pwquality.conf and every drop-in under /etc/security/pwquality.conf.d/, keeping the last dictcheck= value (the one that wins) and requiring it to be >= 1. Resolving the merged drop-in precedence is what a single-file check would miss.
describe command('v=$(grep -rh \'^[[:space:]]*dictcheck[[:space:]]*=\' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/ 2>/dev/null | tail -1 | grep -oE \'[-]?[0-9]+\'); { [ -n "$v" ] && [ "$v" -ge 1 ] && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -rh '^[[:space:]]*dictcheck' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/ | tail -1, the effective line should read dictcheck = 1. Then test live: run passwd and try a common dictionary word (e.g. password); it must be rejected as based on a dictionary word.
Inspect & investigate
PAM rejections are logged to /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL); look for pam_pwquality messages such as "it is based on a dictionary word". journalctl -t passwd also shows password-change attempts. The effective setting is confirmed from the merged pwquality.conf.d drop-ins.
Remediation
pavois harden apply writes the keyval setting dictcheck = 1 into the drop-in /etc/security/pwquality.conf.d/99-Pavois.conf, overriding distro defaults. No restart is required, PAM picks up the change at the next passwd / authentication.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/security/pwquality.conf.d/99-pavois.conf |
|---|---|
| key | dictcheck |
| resource | keyval |
| value | 1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Only new or changed passwords are affected; existing passwords keep working, so there is no lockout risk on apply. Users may be surprised when familiar passwords are refused for resembling dictionary words, communicate the policy and steer them toward passphrases. Automated tooling that sets word-based passwords will start failing, so update any such generators before enforcing fleet-wide.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.3.3.2.6 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), IA-5(1)(a), IA-5(4), IA-5(c) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-611030, UBTU-24-300014 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.