mediumaccess-controlverified ✓rollback-safe
Require minimum character classes in password
pam-pwquality-minclass · RHEL ≥ 8 · 1 impl
Description
The minclass parameter in /etc/security/pwquality.conf sets the minimum number of character classes (uppercase, lowercase, digits, special) that must be present in a password.
Rationale
Requiring multiple character classes ensures password diversity and makes passwords more resistant to attacks. A minimum of 4 classes provides strong protection.
Check → Remediate
Checkconfig_value
- path:
- /etc/security/pwquality.conf
- key:
- minclass
- expected:
- {{ pam_pwquality_minclass }}
- comparator:
- >=
Remediateconfig_set
- path:
- /etc/security/pwquality.conf
- key:
- minclass
- value:
- {{ pam_pwquality_minclass }}
- separator:
- =
Framework references
CIS
rhel8 5.4.1.6rhel9 5.3.3.2.3rhel10 5.3.2.2.3
STIG
V-258115 / RHEL-09-611130V-230362V-281189 / RHEL-10-600300
NIST 800-53
IA-5(1)(a)
Live verification
rhel10:checkrhel8:checkrhel9:check
#pam#password#authentication#pwquality