mediumaccess-controlverified ✓rollback-safe
Ensure pam_pwquality module is enabled
pam-pwquality-enabled · RHEL ≥ 8 · 2 impls
Description
The pam_pwquality module must be enabled in the PAM configuration.
Rationale
pam_pwquality enforces password complexity requirements, preventing weak passwords.
Check → Remediate
Checkcommand
if grep -qE '^\s*(password|auth).*pam_pwquality\.so' /etc/pam.d/system-auth /etc/pam.d/password-auth 2>/dev/null; then echo "OK: pam_pwquality configured" exit 0 fi echo "FAIL: pam_pwquality not enabled" exit 1
- expected_exit:
- 0
Remediatepam_module_configure
- service:
- system-auth
- module:
- pam_pwquality.so
- type:
- password
- control:
- requisite
- args:
- local_users_only
Framework references
CIS
rhel9 5.3.2.3rhel10 5.3.1.3rhel8 5.3.2.3
NIST 800-53
IA-5
Live verification
rhel10:checkrhel8:checkrhel9:check
#pam#authentication#pwquality