Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class
Limits how many consecutive characters may come from the same character class (e.g. all digits, all lowercase) in a password by setting maxclassrepeat = 4.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
Why this rule matters
A complex password increases the time and resources needed to compromise it. The maxclassrepeat parameter rejects passwords with long stretches drawn from a single class (e.g. aaaaa, 12345 of digits, abcde of lowercase). Such monoclass runs reduce effective entropy and produce predictable structures that cracking tools exploit. Capping them at 4 forces interleaving of classes and widens the search space.
What Pavois checks
Pavois reads the effective maxclassrepeat value across /etc/security/pwquality.conf and all drop-ins under /etc/security/pwquality.conf.d/, keeping the last definition that wins at runtime. A file-based scanner reading only the main config would miss a value set in a drop-in. The control passes only when the resolved value is <= 4 (and non-zero, since 0 disables the check).
describe command('v=$(grep -rh \'^[[:space:]]*maxclassrepeat[[:space:]]*=\' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/ 2>/dev/null | tail -1 | grep -oE \'[-]?[0-9]+\'); { [ -n "$v" ] && [ "$v" -le 4 ] && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -rh '^[[:space:]]*maxclassrepeat' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/ | tail -1. The effective line must read maxclassrepeat = 4 (or any value 1..4).
Inspect & investigate
Password changes rejected for too many same-class characters in a row are logged via PAM in /var/log/secure (RHEL family) with pam_pwquality messages like "Too many characters of the same class consecutively". Inspect the live setting with grep -r maxclassrepeat /etc/security/pwquality.conf.d/.
Remediation
pavois harden apply writes maxclassrepeat = 4 to the drop-in /etc/security/pwquality.conf.d/99-Pavois.conf via the idempotent keyval resource. The 99- prefix ensures it overrides any earlier value. No service restart is needed; it applies at the next password change.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/security/pwquality.conf.d/99-pavois.conf |
|---|---|
| key | maxclassrepeat |
| resource | keyval |
| value | 4 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
This control applies only to RHEL 8/9 (it is not part of CIS/STIG profiles, hence empty norms). Existing passwords stay valid; only new passwords are constrained. Users picking passwords with five or more consecutive same-class characters will be rejected. Lockout risk is minimal; setting maxclassrepeat = 0 would disable the check, so confirm the value is 1..4.