Ensure PAM Enforces Password Requirements - Minimum Length
Forces pam_pwquality to require passwords of at least 15 characters by setting minlen = 15.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Length is the single strongest lever on password strength: each additional character multiplies the number of combinations an attacker must test. The shorter the password, the fewer combinations to try before it is compromised. A minimum of 15 characters exponentially raises the time and resources needed for brute-force attacks. Short passwords, even complex ones, fall quickly to modern GPU-accelerated cracking.
What Pavois checks
Pavois reads the effective minlen value across /etc/security/pwquality.conf and all drop-ins under /etc/security/pwquality.conf.d/, keeping the last definition that wins at runtime. A file-based scanner reading only the main config would miss a stricter (or weaker) value set in a drop-in. The control passes only when the resolved value is >= 15.
describe command('v=$(grep -rh \'^[[:space:]]*minlen[[:space:]]*=\' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/ 2>/dev/null | tail -1 | grep -oE \'[-]?[0-9]+\'); { [ -n "$v" ] && [ "$v" -ge 15 ] && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -rh '^[[:space:]]*minlen' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/ | tail -1. The effective line must read minlen = 15 (or any value >= 15).
Inspect & investigate
Password changes rejected for being too short are logged via PAM in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL family) with pam_pwquality messages like "The password is shorter than 15 characters". Inspect the live setting with grep -r minlen /etc/security/pwquality.conf.d/.
Remediation
pavois harden apply writes minlen = 15 to the drop-in /etc/security/pwquality.conf.d/99-Pavois.conf via the idempotent keyval resource. The 99- prefix ensures it overrides any earlier value. No service restart is needed; it applies at the next password change.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/security/pwquality.conf.d/99-pavois.conf |
|---|---|
| key | minlen |
| resource | keyval |
| value | 15 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Existing passwords stay valid; only new passwords must be 15+ characters. Users with shorter habits will be rejected at change time and should be guided toward passphrases. Lockout risk is low, but before applying confirm that automated provisioning, service accounts and password-rotation scripts generate passwords of at least 15 characters, otherwise account creation may fail.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R31 | direct | 2.0 | high |
| CIS | 5.3.3.2.2, 8.3.6 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), IA-5(1)(a), IA-5(4), IA-5(c) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 8.3.6 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-611035, UBTU-24-400320 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.