Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
Caps the number of password prompts pam_pwquality allows in a single session by setting retry = 3.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Setting the number of per-session password prompts to a low value forces some software, such as SSH, to re-connect after exhausting its retries. This slows down and draws attention to certain password-guessing attacks by limiting how many attempts an attacker can make per connection. Note this is distinct from account lockout, which is enforced separately by pam_faillock; retry only bounds prompts within one authentication session.
What Pavois checks
Pavois reads the effective retry value across /etc/security/pwquality.conf and all drop-ins under /etc/security/pwquality.conf.d/, keeping the last definition that wins at runtime. A file-based scanner reading only the main config would miss a value set in a drop-in. The control passes only when the resolved value is <= 3.
describe command('v=$(grep -rh \'^[[:space:]]*retry[[:space:]]*=\' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/ 2>/dev/null | tail -1 | grep -oE \'[-]?[0-9]+\'); { [ -n "$v" ] && [ "$v" -le 3 ] && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -rh '^[[:space:]]*retry' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/ | tail -1. The effective line must read retry = 3 (or any value <= 3).
Inspect & investigate
Authentication and password-change retries are logged via PAM in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL family); look for repeated pam_pwquality failures within a session, and use journalctl -u ssh to correlate SSH re-connections. Inspect the live setting with grep -r retry /etc/security/pwquality.conf.d/.
Remediation
pavois harden apply writes retry = 3 to the drop-in /etc/security/pwquality.conf.d/99-Pavois.conf via the idempotent keyval resource. The 99- prefix ensures it overrides any earlier value. No service restart is needed; it applies at the next authentication.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/security/pwquality.conf.d/99-pavois.conf |
|---|---|
| key | retry |
| resource | keyval |
| value | 3 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A low retry value mildly affects interactive UX: a user mistyping a new password more than 3 times must restart the operation (and over SSH, re-connect). This does not lock accounts. Precaution: ensure retry is not duplicated with a conflicting value in the PAM stack (pam_pwquality.so retry=N in /etc/pam.d/), since the PAM-line argument can override the pwquality.conf value on some distros.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R68 | direct | 2.0 | high |
| NIST | AC-7(a), CM-6(a), IA-5(4) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-611045, UBTU-24-300016 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.