Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
Forces pam_pwquality to require at least one lowercase letter in every new password by setting lcredit = -1.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
A complex password increases the time and resources needed to compromise it. The lcredit parameter controls how lowercase letters contribute to a password's strength: a value of -1 means at least one lowercase character is mandatory. Requiring lowercase letters enlarges the character search space, making brute-force and dictionary attacks measurably harder. Without it, users can pick passwords drawn from a narrow alphabet that fall quickly to guessing attacks.
What Pavois checks
Pavois reads the effective lcredit value by scanning /etc/security/pwquality.conf and every drop-in under /etc/security/pwquality.conf.d/, keeping the last definition that actually wins at runtime. A file-based scanner that only inspects the main pwquality.conf would miss a value overridden (or set) by a drop-in, producing a false result. The control passes only when the resolved value is <= -1.
describe command('v=$(grep -rh \'^[[:space:]]*lcredit[[:space:]]*=\' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/ 2>/dev/null | tail -1 | grep -oE \'[-]?[0-9]+\'); { [ -n "$v" ] && [ "$v" -le -1 ] && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -rh '^[[:space:]]*lcredit' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/ | tail -1. The effective line must read lcredit = -1 (or any value <= -1).
Inspect & investigate
Password-change attempts that fail complexity are logged via PAM in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL family); look for pam_pwquality messages such as "The password does not contain enough character classes". Inspect the live config with grep -r lcredit /etc/security/pwquality.conf.d/.
Remediation
pavois harden apply writes lcredit = -1 to the drop-in /etc/security/pwquality.conf.d/99-Pavois.conf using the keyval resource (an idempotent key/value editor). The high 99- prefix guarantees it overrides any earlier setting. No service restart is needed; the change applies to the next password change.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/security/pwquality.conf.d/99-pavois.conf |
|---|---|
| key | lcredit |
| resource | keyval |
| value | -1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Existing passwords are not invalidated; the rule only constrains new passwords. Users who try to set a password with no lowercase letter will be rejected at change time. Risk of lockout is low, but before applying ensure your automated provisioning or password-rotation scripts generate compliant passwords (at least one lowercase letter), otherwise account creation could fail.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R31 | direct | 2.0 | high |
| CIS | 5.3.3.2.3, 8.3.6 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), IA-5(1)(a), IA-5(4), IA-5(c) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 8.3.6 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-611015, UBTU-24-400270 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.