mediumaccess-controlverified ✓rollback-safe
Enable pam_pwquality module in /etc/pam.d/system-auth
pam-pwquality-system-auth · RHEL ≥ 8 · 2 impls
Description
The pam_pwquality.so module must be enabled in /etc/pam.d/system-auth to enforce password complexity requirements during password changes.
Rationale
Without pam_pwquality in the system-auth PAM configuration, password complexity rules will not be enforced for authentication paths that use system-auth, allowing weak passwords to be set.
Check → Remediate
Checkcommand
grep -qE '^\s*password\s+.*pam_pwquality\.so' /etc/pam.d/system-auth 2>/dev/null
- expected_exit:
- 0
Remediatepam_module_configure
- service:
- system-auth
- module:
- pam_pwquality.so
- type:
- password
- control:
- requisite
- args:
- local_users_only
Framework references
STIG
V-281215 / RHEL-10-600630V-258098 / RHEL-09-611045V-251713
NIST 800-53
IA-5(1)
Live verification
rhel8:checkrhel9:check
#pam#pwquality#password-complexity#system-auth