Password strength
Australian Cyber Security Centre · Information Security Manual v2026.09.4 · Applicability NC, OS, P, S, TS
Passwords using a sequence of words for single-factor authentication are not constructed using:
partial Applicability claimed: NC, OS, P, S, TS
Partially implemented. This component enforces the word-count limb. Sequences, repeats and account-derived strings are rejected by debian-13-pam-pwquality; the provenance limbs are not enforced by any component.
ENFORCED, verified by behaviour through the PAM stack on all three applicability tiers: a password using a sequence of words must use at least 4 words on non-classified, OFFICIAL: Sensitive and PROTECTED systems, 5 on SECRET and 6 on TOP SECRET. This is implemented by pam_ism_wordcount.so, a purpose-built PAM module that counts whitespace-delimited words in a single read-only pass. It runs in-process, so the candidate never leaves the PAM process. A pam_exec(8) shell equivalent is shipped as a fallback for hosts that cannot deploy a compiled module; pam_exec ships in libpam-modules, so neither route requires an additional package.
Crucially, the check applies ONLY to passwords that are a sequence of words. A single-token password is not one, so it is passed through untouched. That is what allows this control and ism-2080 to hold simultaneously; see the remarks for why a character-class module cannot.
NOT ENFORCED: a sequence of categorised words, a real sentence in natural language, and song lyrics, quotes or other publicly available material all satisfy a word count while being exactly what this control prohibits. Verified: all three are still accepted. Determining whether words were randomly selected is not something any available module can do.
Residual risk Word count is enforced; randomness and provenance of the words are not. Natural-language sentences, lyrics and categorised word lists remain accepted.
sha256 c9f4008474a815df91fddcfe707d809c0fff207d831ed27362205abdf526d646sha256 f9d3ae6b5ed756e558b3eb7a542a620f04fee77a3e5020e6906e921c3fedb247sha256 9b90684ccdbd5fdedb3f2940d65b26e7631e7706e4384696057d11edb0ed5b92sha256 75c74b0466a39f6a66694c2dca9e11225bb02b0829919017094b05e7d6645e40sha256 6eab210aa9c8edf77481d35e108cd7b165e0a8e7b0ae2b44d630840f34b1d84fpartial Applicability claimed: NC, OS, P, S, TS
Partially implemented. maxsequence = 4 rejects monotonic runs, maxrepeat = 3 rejects repeated characters, and usercheck, usersubstr and gecoscheck reject strings derived from the account itself.
NOT ENFORCED here: the minimum word count, which debian-13-pam-wordcount enforces and which depends on this family. Nor is word provenance: a sequence of categorised words, a real sentence in natural language, and song lyrics or quotes all satisfy the rules above while being exactly what this control prohibits. Verified: all three are still accepted.
Residual risk Only the character-level limbs are enforced here. The word count is debian-13-pam-wordcount’s, and natural-language sentences, lyrics and categorised word lists remain accepted.
sha256 96f51d6b8a4ccb07e4272f6978674c948a8a80c65b46ced85a247334a9667cf9sha256 ab8f781d6493ceb3a0f28b3705a101413e6f06ac9744924063ca96bc293e5299This control's implementations as an OSCAL component definition (newest version of each component)