mediumaccess-controlverified ✓rollback-safe
Enable pam_pwquality module in /etc/pam.d/password-auth
pam-pwquality-password-auth · RHEL ≥ 8 · 2 impls
Description
The pam_pwquality.so module must be enabled in /etc/pam.d/password-auth to enforce password complexity requirements during password changes.
Rationale
Without pam_pwquality in the password-auth PAM configuration, password complexity rules will not be enforced for authentication paths that use password-auth, allowing weak passwords to be set.
Check → Remediate
Checkcommand
grep -qE '^\s*password\s+.*pam_pwquality\.so' /etc/pam.d/password-auth 2>/dev/null
- expected_exit:
- 0
Remediatepam_module_configure
- service:
- password-auth
- module:
- pam_pwquality.so
- type:
- password
- control:
- requisite
- args:
- local_users_only
Framework references
STIG
V-281214 / RHEL-10-600620V-258097 / RHEL-09-611040V-230356
NIST 800-53
IA-5(1)
Live verification
rhel8:checkrhel9:check
#pam#pwquality#password-complexity#password-auth