{
  "component-definition": {
    "uuid": "2d43b321-7493-57df-a333-cab58e995b67",
    "metadata": {
      "title": "ISM-2079 Password strength: implementations in the OSCAL Ops Library",
      "last-modified": "2026-09-16T02:00:55Z",
      "version": "0.1.0",
      "oscal-version": "1.1.2",
      "props": [
        {
          "name": "library-view",
          "ns": "https://oscalops.net/ns/library",
          "value": "control-implementations"
        },
        {
          "name": "catalog-release",
          "ns": "https://oscalops.net/ns/library",
          "value": "6f037e85-d69c-5606-874e-1d986ef561a9"
        },
        {
          "name": "control-id",
          "ns": "https://oscalops.net/ns/library",
          "value": "ism-2079"
        }
      ],
      "links": [
        {
          "href": "https://library.oscalops.net/catalogs/acsc-ism/v2026.09.4/controls/ism-2079.json",
          "rel": "canonical"
        }
      ],
      "roles": [
        {
          "id": "system-administrator",
          "title": "System Administrator"
        },
        {
          "id": "system-security-officer",
          "title": "System Security Officer"
        }
      ],
      "parties": [
        {
          "uuid": "1b4346aa-044e-4e42-a524-53d40f60f879",
          "type": "organization",
          "name": "Platform Operations"
        }
      ],
      "remarks": "A derived view: the implemented requirements for ISM-2079 in Information Security Manual v2026.09.4, copied from the newest version of each component definition that addresses it. Each component's source-document property names that version in back matter. Edit the source component definitions, not this view."
    },
    "components": [
      {
        "uuid": "fd553b52-da7a-4459-ba06-acaa9bae0064",
        "type": "software",
        "title": "Debian 13 pam_pwquality enforcement base",
        "description": "pam_pwquality installed on Debian 13 (trixie), stacked ahead of pam_unix, and set to reject rather than warn. It imposes no password rule of its own: each rule is a component that owns its own settings and depends on this one.\n\nA default-settings Debian 13 install has no pam_pwquality at all, so the effective floor is pam_unix's built-in 6 characters, and /etc/security/pwquality.conf ships entirely commented out.\n\nTwo controls are satisfied by omission here, because pam_pwquality imposes neither limit: no maximum length below 64 characters, and no character-set restriction.",
        "purpose": "Provide the enforcement point every ISM password rule for Debian depends on, and evidence for the IA-5(1) elements that follow from it.",
        "props": [
          {
            "name": "os-distribution",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "debian"
          },
          {
            "name": "os-release",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "13"
          },
          {
            "name": "os-codename",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "trixie"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pam-auth-update:pwquality"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:enforcing"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:enforce_for_root"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:local_users_only"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:retry"
          },
          {
            "name": "package",
            "ns": "https://ns.oscalops.net/component-definitions/debian-13-pwquality-base",
            "value": "libpam-pwquality"
          },
          {
            "name": "package-version",
            "ns": "https://ns.oscalops.net/component-definitions/debian-13-pwquality-base",
            "value": "1.4.5-5"
          },
          {
            "name": "pam-stack-priority",
            "ns": "https://ns.oscalops.net/component-definitions/debian-13-pwquality-base",
            "value": "1024 (ahead of pam_unix at 256)"
          },
          {
            "name": "baseline-gap",
            "ns": "https://ns.oscalops.net/component-definitions/debian-13-pwquality-base",
            "value": "stock Debian 13 enforces a 6-character floor via pam_unix"
          },
          {
            "name": "source-document",
            "ns": "https://oscalops.net/ns/library",
            "value": "f7d50635-1903-51f9-8ea6-dbbe6dcbf218"
          }
        ],
        "responsible-roles": [
          {
            "role-id": "system-administrator",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          },
          {
            "role-id": "system-security-officer",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          }
        ],
        "control-implementations": [
          {
            "uuid": "57225e18-ec56-454c-b02b-4423d9bafaa6",
            "source": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json",
            "description": "ISM controls satisfied by pam_pwquality imposing no limit, as published in the ACSC ISM OSCAL catalogue release v2026.09.4.",
            "props": [
              {
                "name": "catalog-release",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "v2026.09.4"
              },
              {
                "name": "catalog-authority",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "Australian Cyber Security Centre"
              },
              {
                "name": "control-family",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "Guidelines for system access > Credential management > Password strength"
              }
            ],
            "links": [
              {
                "href": "#36c41fd6-4e7c-4dbf-92bc-604bf58f40f1",
                "rel": "reference",
                "text": "Pinned ISM catalogue release"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "fdda3216-34bd-4b93-ad2f-3406f430f342",
                "control-id": "ism-2079",
                "description": "Implemented by omission. Neither pam_pwquality nor any drop-in in this family configures a maximum length, and pam_unix uses yescrypt, which does not truncate. The effective ceiling is the PAM response buffer, far above the 64-character floor this control requires.\n\nVerified: a 72-character passphrase is accepted by pwscore(1).",
                "props": [
                  {
                    "name": "implementation-status",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "implemented"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "NC"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "OS"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "P"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "S"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "TS"
                  },
                  {
                    "name": "correlates-nist-statement",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "ia-5.1_smt.f"
                  },
                  {
                    "name": "correlation-strength",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "equivalent"
                  },
                  {
                    "name": "assessment-method",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "test"
                  },
                  {
                    "name": "assessment-frequency",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "annual"
                  }
                ],
                "links": [
                  {
                    "href": "#6f683bed-835f-4dd1-813b-075cf24c1fc5",
                    "rel": "reference",
                    "text": "Enforcement base drop-in"
                  },
                  {
                    "href": "#972a2357-ac76-4414-862e-bfd204832bed",
                    "rel": "reference",
                    "text": "Verification script"
                  }
                ],
                "responsible-roles": [
                  {
                    "role-id": "system-administrator",
                    "party-uuids": [
                      "1b4346aa-044e-4e42-a524-53d40f60f879"
                    ]
                  }
                ]
              }
            ]
          }
        ]
      }
    ],
    "back-matter": {
      "resources": [
        {
          "uuid": "6f037e85-d69c-5606-874e-1d986ef561a9",
          "title": "Information Security Manual",
          "props": [
            {
              "name": "version",
              "value": "v2026.09.4"
            },
            {
              "name": "library-item",
              "ns": "https://oscalops.net/ns/library",
              "value": "catalog-release"
            },
            {
              "name": "catalog-key",
              "ns": "https://oscalops.net/ns/library",
              "value": "acsc-ism"
            },
            {
              "name": "authority",
              "ns": "https://oscalops.net/ns/library",
              "value": "Australian Cyber Security Centre"
            },
            {
              "name": "licence",
              "ns": "https://oscalops.net/ns/library",
              "value": "CC-BY-4.0"
            },
            {
              "name": "controls",
              "ns": "https://oscalops.net/ns/library",
              "value": "1192"
            }
          ],
          "citation": {
            "text": "ISM OSCAL content from the Australian Signals Directorate's Australian Cyber Security Centre, provided under a Creative Commons Attribution 4.0 International licence, excluding the Coat of Arms and the ASD logo."
          },
          "rlinks": [
            {
              "href": "../ISM_catalog.json",
              "media-type": "application/oscal+json",
              "hashes": [
                {
                  "algorithm": "sha-256",
                  "value": "237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d"
                }
              ]
            },
            {
              "href": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json",
              "media-type": "application/oscal+json",
              "hashes": [
                {
                  "algorithm": "sha-256",
                  "value": "237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d"
                }
              ]
            }
          ]
        },
        {
          "uuid": "f7d50635-1903-51f9-8ea6-dbbe6dcbf218",
          "title": "Debian 13 pam_pwquality Enforcement Base Component Definition",
          "description": "pam_pwquality installed on Debian 13 (trixie), stacked ahead of pam_unix, and set to reject rather than warn. It imposes no password rule of its own: each rule…",
          "props": [
            {
              "name": "version",
              "value": "1.0.0"
            },
            {
              "name": "library-item",
              "ns": "https://oscalops.net/ns/library",
              "value": "component-definition-version"
            },
            {
              "name": "artifact-slug",
              "ns": "https://oscalops.net/ns/library",
              "value": "debian-13-pwquality-base"
            },
            {
              "name": "publication-status",
              "ns": "https://oscalops.net/ns/library",
              "value": "unpublished"
            },
            {
              "name": "assurance-state",
              "ns": "https://oscalops.net/ns/library",
              "value": "technically-tested"
            },
            {
              "name": "source-kind",
              "ns": "https://oscalops.net/ns/library",
              "value": "local"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pwquality-base/1.0.0/component-definition.json",
              "media-type": "application/oscal+json",
              "hashes": [
                {
                  "algorithm": "sha-256",
                  "value": "ae4d53a9c860fc5db447dfba9e519a55d0972d48dfc9d27aeda0e256082692c8"
                }
              ]
            },
            {
              "href": "../../../../component-definitions/debian-13-pwquality-base/1.0.0/index.html",
              "media-type": "text/html"
            }
          ]
        },
        {
          "uuid": "6f683bed-835f-4dd1-813b-075cf24c1fc5",
          "title": "pwquality enforcement base",
          "description": "Installs to /etc/security/pwquality.conf.d/40-ism-base.conf: enforcing, enforce_for_root, local_users_only and retry. It imposes no password rule.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "pwquality-config"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pwquality-base/1.0.0/config/pwquality.conf.d/40-ism-base.conf",
              "media-type": "text/plain"
            }
          ]
        },
        {
          "uuid": "972a2357-ac76-4414-862e-bfd204832bed",
          "title": "Verification script",
          "description": "Asserts that the stack enforces, that no maximum length or character-set restriction is imposed, and that this component owns its settings alone.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "shell-script"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pwquality-base/1.0.0/scripts/verify-pwquality-base.sh",
              "media-type": "text/plain"
            }
          ]
        },
        {
          "uuid": "36c41fd6-4e7c-4dbf-92bc-604bf58f40f1",
          "title": "ACSC ISM OSCAL catalogue v2026.09.4",
          "description": "Australian Cyber Security Centre Information Security Manual OSCAL catalogue, release v2026.09.4: the release this document's control identifiers resolve against.",
          "props": [
            {
              "name": "release-tag",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "v2026.09.4"
            },
            {
              "name": "sha256",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d"
            }
          ],
          "rlinks": [
            {
              "href": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json",
              "media-type": "application/json"
            }
          ]
        }
      ]
    }
  }
}