Ensure PAM Enforces Password Requirements - Minimum Different Characters
Sets pwquality difok = 2 so a new password must differ from the old one by at least 2 characters, preventing trivial password recycling.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Password strength measures resistance to guessing and brute-force attacks. When users change a password, they tend to make a minimal tweak to the previous one (e.g. incrementing a trailing digit). difok requires a minimum number of characters to differ from the old password, so a freshly changed password does not closely resemble a previously compromised one. Note that on an already-compromised system a changed password may still be exposed.
What Pavois checks
Pavois reads the effective pwquality configuration by grepping /etc/security/pwquality.conf and every drop-in under /etc/security/pwquality.conf.d/, keeping the last difok= value (the one that wins) and requiring it to be >= 2. Resolving merged drop-in precedence is what a single-file inspection would miss.
describe command('v=$(grep -rh \'^[[:space:]]*difok[[:space:]]*=\' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/ 2>/dev/null | tail -1 | grep -oE \'[-]?[0-9]+\'); { [ -n "$v" ] && [ "$v" -ge 2 ] && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -rh '^[[:space:]]*difok' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/ | tail -1, the effective line should read difok = 2 (or higher). Then test live: run passwd and try a new password that differs from the old one by a single character; it must be rejected as too similar.
Inspect & investigate
PAM rejections are logged to /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL); look for pam_pwquality messages such as "is too similar to the old one". journalctl -t passwd shows change attempts. The effective value is confirmed from the merged pwquality.conf.d drop-ins.
Remediation
pavois harden apply writes the keyval setting difok = 2 into the drop-in /etc/security/pwquality.conf.d/99-Pavois.conf, overriding distro defaults. No restart is required, PAM applies it at the next passwd.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/security/pwquality.conf.d/99-pavois.conf |
|---|---|
| key | difok |
| resource | keyval |
| value | 2 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Only password changes are affected; existing passwords keep working, so there is no lockout risk on apply. The visible effect is that users can no longer make a one-character tweak when rotating a password, communicate this so changes are not perceived as failing. Note difok is checked only when the old password is known to PAM (interactive passwd); an admin force-resetting another user's password is not constrained by it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.3.3.2.1 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), IA-5(1)(b), IA-5(4), IA-5(c) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-611040, UBTU-24-400290 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.