{
  "component-definition": {
    "uuid": "a80af2fd-5cde-59f1-a800-bbc1477740c9",
    "metadata": {
      "title": "IA-5(1) Password-based Authentication: implementations in the OSCAL Ops Library",
      "last-modified": "2026-09-16T02:00:55Z",
      "version": "0.1.0",
      "oscal-version": "1.1.2",
      "props": [
        {
          "name": "library-view",
          "ns": "https://oscalops.net/ns/library",
          "value": "control-implementations"
        },
        {
          "name": "catalog-release",
          "ns": "https://oscalops.net/ns/library",
          "value": "abc3329a-ebc9-547f-9ace-29146be7da9c"
        },
        {
          "name": "control-id",
          "ns": "https://oscalops.net/ns/library",
          "value": "ia-5.1"
        }
      ],
      "links": [
        {
          "href": "https://library.oscalops.net/catalogs/nist-sp800-53-rev5/v1.4.0/controls/ia-5.1.json",
          "rel": "canonical"
        }
      ],
      "roles": [
        {
          "id": "system-administrator",
          "title": "System Administrator"
        },
        {
          "id": "system-security-officer",
          "title": "System Security Officer"
        }
      ],
      "parties": [
        {
          "uuid": "1b4346aa-044e-4e42-a524-53d40f60f879",
          "type": "organization",
          "name": "Platform Operations"
        }
      ],
      "remarks": "A derived view: the implemented requirements for IA-5(1) in SP 800-53 Revision 5 v1.4.0, copied from the newest version of each component definition that addresses it. Each component's source-document property names that version in back matter. Edit the source component definitions, not this view."
    },
    "components": [
      {
        "uuid": "85e7add0-7c26-40a8-8147-8ab63ad5e29e",
        "type": "software",
        "title": "Debian 13 password hashing (yescrypt)",
        "description": "Passwords on Debian 13 (trixie) are stored as yescrypt hashes: a salted, memory-hard key derivation function. pam_unix hashes password changes made through PAM with its yescrypt option, and tools that bypass PAM follow ENCRYPT_METHOD YESCRYPT in /etc/login.defs.\n\nBoth are Debian 13 defaults. This component configures nothing: it asserts the defaults and ships a verification script that makes the assertion checkable, including by inspecting a hash actually stored for a throwaway account.",
        "purpose": "Evidence that stored passwords use an approved, salted key derivation function (IA-5(1)(d)).",
        "props": [
          {
            "name": "os-distribution",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "debian"
          },
          {
            "name": "os-release",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "13"
          },
          {
            "name": "os-codename",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "trixie"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "login.defs:ENCRYPT_METHOD"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pam_unix:hashing-algorithm"
          },
          {
            "name": "configuration",
            "ns": "https://ns.oscalops.net/component-definitions/debian-13-password-hashing",
            "value": "none; asserts Debian 13 defaults"
          },
          {
            "name": "source-document",
            "ns": "https://oscalops.net/ns/library",
            "value": "e233b74e-8c37-54e5-a257-e03e7b65b40f"
          }
        ],
        "responsible-roles": [
          {
            "role-id": "system-administrator",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          },
          {
            "role-id": "system-security-officer",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          }
        ],
        "control-implementations": [
          {
            "uuid": "92fd3572-d0b4-4aef-8220-24bd23393dbc",
            "source": "https://raw.githubusercontent.com/usnistgov/oscal-content/v1.4.0/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json",
            "description": "The SP 800-53 Rev 5 IA-5(1) password-storage statement, from oscal-content release v1.4.0.",
            "props": [
              {
                "name": "catalog-release",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "v1.4.0"
              },
              {
                "name": "catalog-authority",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "NIST"
              }
            ],
            "links": [
              {
                "href": "#afd178e1-5b19-45b3-8179-db808eae36de",
                "rel": "reference",
                "text": "Pinned SP 800-53 catalogue release"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "5c9c80ad-6aff-4c4d-9fa2-d10d7689f2dd",
                "control-id": "ia-5.1",
                "description": "This component claims only IA-5(1)(d), password storage. The other elements of IA-5(1) are claimed by debian-13-pam-pwquality, or by no component; see debian-13-passphrase-hardening.",
                "props": [
                  {
                    "name": "implementation-status",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "partial"
                  },
                  {
                    "name": "assessment-method",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "test"
                  },
                  {
                    "name": "assessment-frequency",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "annual"
                  }
                ],
                "links": [
                  {
                    "href": "#ee16f362-2b86-4dbd-9e25-c7be0d099b92",
                    "rel": "reference",
                    "text": "Verification script"
                  }
                ],
                "statements": [
                  {
                    "statement-id": "ia-5.1_smt.d",
                    "uuid": "2f1df235-3eda-5131-84cd-0f93adf92e48",
                    "description": "Passwords are stored using yescrypt, a salted, memory-hard key derivation function: pam_unix.so names yescrypt in /etc/pam.d/common-password, and /etc/login.defs sets ENCRYPT_METHOD YESCRYPT. Verified by inspecting the hash stored when a password is set on a throwaway account.",
                    "props": [
                      {
                        "name": "implementation-status",
                        "ns": "https://ns.oscalops.net/component-definitions",
                        "value": "implemented"
                      }
                    ],
                    "responsible-roles": [
                      {
                        "role-id": "system-administrator",
                        "party-uuids": [
                          "1b4346aa-044e-4e42-a524-53d40f60f879"
                        ]
                      }
                    ],
                    "remarks": "yescrypt is the Debian 13 default and is retained rather than changed; the component asserts and verifies it rather than configuring it."
                  }
                ],
                "responsible-roles": [
                  {
                    "role-id": "system-administrator",
                    "party-uuids": [
                      "1b4346aa-044e-4e42-a524-53d40f60f879"
                    ]
                  }
                ]
              }
            ]
          }
        ]
      },
      {
        "uuid": "fd553b52-da7a-4459-ba06-acaa9bae0064",
        "type": "software",
        "title": "Debian 13 pam_pwquality enforcement base",
        "description": "pam_pwquality installed on Debian 13 (trixie), stacked ahead of pam_unix, and set to reject rather than warn. It imposes no password rule of its own: each rule is a component that owns its own settings and depends on this one.\n\nA default-settings Debian 13 install has no pam_pwquality at all, so the effective floor is pam_unix's built-in 6 characters, and /etc/security/pwquality.conf ships entirely commented out.\n\nTwo controls are satisfied by omission here, because pam_pwquality imposes neither limit: no maximum length below 64 characters, and no character-set restriction.",
        "purpose": "Provide the enforcement point every ISM password rule for Debian depends on, and evidence for the IA-5(1) elements that follow from it.",
        "props": [
          {
            "name": "os-distribution",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "debian"
          },
          {
            "name": "os-release",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "13"
          },
          {
            "name": "os-codename",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "trixie"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pam-auth-update:pwquality"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:enforcing"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:enforce_for_root"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:local_users_only"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:retry"
          },
          {
            "name": "package",
            "ns": "https://ns.oscalops.net/component-definitions/debian-13-pwquality-base",
            "value": "libpam-pwquality"
          },
          {
            "name": "package-version",
            "ns": "https://ns.oscalops.net/component-definitions/debian-13-pwquality-base",
            "value": "1.4.5-5"
          },
          {
            "name": "pam-stack-priority",
            "ns": "https://ns.oscalops.net/component-definitions/debian-13-pwquality-base",
            "value": "1024 (ahead of pam_unix at 256)"
          },
          {
            "name": "baseline-gap",
            "ns": "https://ns.oscalops.net/component-definitions/debian-13-pwquality-base",
            "value": "stock Debian 13 enforces a 6-character floor via pam_unix"
          },
          {
            "name": "source-document",
            "ns": "https://oscalops.net/ns/library",
            "value": "f7d50635-1903-51f9-8ea6-dbbe6dcbf218"
          }
        ],
        "responsible-roles": [
          {
            "role-id": "system-administrator",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          },
          {
            "role-id": "system-security-officer",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          }
        ],
        "control-implementations": [
          {
            "uuid": "85fa45b8-3134-44cf-aabc-98371d5af201",
            "source": "https://raw.githubusercontent.com/usnistgov/oscal-content/v1.4.0/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json",
            "description": "SP 800-53 Rev 5 elements that follow from the enforcement point itself, from oscal-content release v1.4.0.",
            "props": [
              {
                "name": "catalog-release",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "v1.4.0"
              },
              {
                "name": "catalog-authority",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "NIST"
              }
            ],
            "links": [
              {
                "href": "#afd178e1-5b19-45b3-8179-db808eae36de",
                "rel": "reference",
                "text": "Pinned SP 800-53 catalogue release"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "a15b67ad-0197-406e-9594-d497fdec8a79",
                "control-id": "ia-5.1",
                "description": "This component claims the IA-5(1) elements that follow from pam_pwquality being installed and enforcing: every password change is checked, long passphrases and the full printable character set are accepted, and password tooling is available. The content rules themselves are claimed by the rule components that own them.",
                "props": [
                  {
                    "name": "implementation-status",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "partial"
                  },
                  {
                    "name": "assessment-method",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "test"
                  },
                  {
                    "name": "assessment-frequency",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "annual"
                  }
                ],
                "links": [
                  {
                    "href": "#972a2357-ac76-4414-862e-bfd204832bed",
                    "rel": "reference",
                    "text": "Verification script"
                  }
                ],
                "statements": [
                  {
                    "statement-id": "ia-5.1_smt.b",
                    "uuid": "5cdd6e6d-9a3f-5a29-b460-b8dab7de62a3",
                    "description": "pam_pwquality runs as 'requisite' in the password stack, so every password creation and change is checked against the dictionary before pam_unix is reached.",
                    "props": [
                      {
                        "name": "implementation-status",
                        "ns": "https://ns.oscalops.net/component-definitions",
                        "value": "implemented"
                      },
                      {
                        "name": "correlates-ism-control",
                        "ns": "https://ns.oscalops.net/component-definitions",
                        "value": "ism-2078"
                      }
                    ],
                    "responsible-roles": [
                      {
                        "role-id": "system-administrator",
                        "party-uuids": [
                          "1b4346aa-044e-4e42-a524-53d40f60f879"
                        ]
                      }
                    ]
                  },
                  {
                    "statement-id": "ia-5.1_smt.f",
                    "uuid": "55c38cc2-853b-59af-a92a-c36e15c48051",
                    "description": "No maximum length and no character-set restriction are configured, and yescrypt does not truncate. Long passphrases including spaces and the full ASCII printable range are accepted. Verified at 72 characters and across the ASCII printable set.",
                    "props": [
                      {
                        "name": "implementation-status",
                        "ns": "https://ns.oscalops.net/component-definitions",
                        "value": "implemented"
                      },
                      {
                        "name": "correlates-ism-control",
                        "ns": "https://ns.oscalops.net/component-definitions",
                        "value": "ism-2079 ism-2081"
                      }
                    ],
                    "responsible-roles": [
                      {
                        "role-id": "system-administrator",
                        "party-uuids": [
                          "1b4346aa-044e-4e42-a524-53d40f60f879"
                        ]
                      }
                    ]
                  },
                  {
                    "statement-id": "ia-5.1_smt.g",
                    "uuid": "48beb3b9-0c3e-540a-861a-fd7f211af1df",
                    "description": "libpwquality-tools provides pwmake(1), which generates high-entropy candidates, and pwscore(1), which scores a candidate against the live policy. Both are installed by the apply script.",
                    "props": [
                      {
                        "name": "implementation-status",
                        "ns": "https://ns.oscalops.net/component-definitions",
                        "value": "implemented"
                      }
                    ],
                    "responsible-roles": [
                      {
                        "role-id": "system-administrator",
                        "party-uuids": [
                          "1b4346aa-044e-4e42-a524-53d40f60f879"
                        ]
                      }
                    ],
                    "remarks": "pwmake also partially mitigates the ism-1558 word-count residual by removing the need for users to select words themselves."
                  }
                ],
                "responsible-roles": [
                  {
                    "role-id": "system-administrator",
                    "party-uuids": [
                      "1b4346aa-044e-4e42-a524-53d40f60f879"
                    ]
                  }
                ]
              }
            ]
          }
        ]
      },
      {
        "uuid": "0a283933-bb57-4cb8-b6c4-064280d959cd",
        "type": "software",
        "title": "Debian 13 ISM Dictionary Checking",
        "description": "ism-2078 requires that commonly used or compromised passwords are not used. dictcheck evaluates every candidate against the cracklib dictionary from cracklib-runtime, and badwords adds organisation-specific terms.\n\nPartially implemented, and measured rather than assumed: the stock cracklib dictionary is a common-word corpus, not a breach-credential corpus. Depends on debian-13-pwquality-base.",
        "purpose": "Reject commonly used passwords and organisation-specific terms on local Debian accounts.",
        "props": [
          {
            "name": "os-distribution",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "debian"
          },
          {
            "name": "os-release",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "13"
          },
          {
            "name": "os-codename",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "trixie"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:dictcheck"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:badwords"
          },
          {
            "name": "source-document",
            "ns": "https://oscalops.net/ns/library",
            "value": "9f9b89f2-ee5f-5ef6-b260-d3d5e2cb3177"
          }
        ],
        "links": [
          {
            "href": "#c6aaa027-2fa1-4d12-a806-c29641030292",
            "rel": "depends-on",
            "text": "pam_pwquality must be installed and enforcing"
          }
        ],
        "responsible-roles": [
          {
            "role-id": "system-administrator",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          }
        ],
        "control-implementations": [
          {
            "uuid": "32e058de-60e7-44ee-b2b4-842b9523562d",
            "source": "https://raw.githubusercontent.com/usnistgov/oscal-content/v1.4.0/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json",
            "description": "The SP 800-53 Rev 5 dictionary element, from oscal-content release v1.4.0.",
            "props": [
              {
                "name": "catalog-release",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "v1.4.0"
              },
              {
                "name": "catalog-authority",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "NIST"
              }
            ],
            "links": [
              {
                "href": "#afd178e1-5b19-45b3-8179-db808eae36de",
                "rel": "reference",
                "text": "Pinned SP 800-53 catalogue release"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "2d7e880e-0ce6-4916-8524-e3b7d0912ff5",
                "control-id": "ia-5.1",
                "description": "This component claims only IA-5(1)(a), the list of commonly used, expected or compromised passwords, and binds the parameter for how often that list is updated.",
                "props": [
                  {
                    "name": "implementation-status",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "partial"
                  },
                  {
                    "name": "assessment-method",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "test"
                  },
                  {
                    "name": "assessment-frequency",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "monthly"
                  }
                ],
                "links": [
                  {
                    "href": "#71ac359d-3b86-4752-af35-7cad91128b5c",
                    "rel": "reference",
                    "text": "Verification script"
                  }
                ],
                "set-parameters": [
                  {
                    "param-id": "ia-05.01_odp.01",
                    "values": [
                      "monthly, and immediately upon notification of a credential compromise affecting the system"
                    ],
                    "remarks": "Cadence for refreshing the cracklib dictionary that backs dictcheck. Bound to the ism-2078 residual."
                  }
                ],
                "statements": [
                  {
                    "statement-id": "ia-5.1_smt.a",
                    "uuid": "a6a9df0e-a9d5-51af-877a-71efb17ab8c9",
                    "description": "dictcheck = 1 evaluates candidates against the cracklib dictionary, and the refresh cadence is bound to ia-05.01_odp.01. Measured effectiveness is low: 1 of 8 long common passwords was rejected at minlen 15. cracklib is a common-word corpus, not a list of compromised passwords, so this element is partial and the substantive requirement is unmet until a breach corpus is loaded.",
                    "props": [
                      {
                        "name": "implementation-status",
                        "ns": "https://ns.oscalops.net/component-definitions",
                        "value": "partial"
                      },
                      {
                        "name": "correlates-ism-control",
                        "ns": "https://ns.oscalops.net/component-definitions",
                        "value": "ism-2078"
                      }
                    ],
                    "responsible-roles": [
                      {
                        "role-id": "system-administrator",
                        "party-uuids": [
                          "1b4346aa-044e-4e42-a524-53d40f60f879"
                        ]
                      }
                    ]
                  }
                ],
                "responsible-roles": [
                  {
                    "role-id": "system-administrator",
                    "party-uuids": [
                      "1b4346aa-044e-4e42-a524-53d40f60f879"
                    ]
                  }
                ]
              }
            ]
          }
        ]
      }
    ],
    "back-matter": {
      "resources": [
        {
          "uuid": "abc3329a-ebc9-547f-9ace-29146be7da9c",
          "title": "SP 800-53 Revision 5",
          "props": [
            {
              "name": "version",
              "value": "v1.4.0"
            },
            {
              "name": "library-item",
              "ns": "https://oscalops.net/ns/library",
              "value": "catalog-release"
            },
            {
              "name": "catalog-key",
              "ns": "https://oscalops.net/ns/library",
              "value": "nist-sp800-53-rev5"
            },
            {
              "name": "authority",
              "ns": "https://oscalops.net/ns/library",
              "value": "NIST"
            },
            {
              "name": "licence",
              "ns": "https://oscalops.net/ns/library",
              "value": "CC0-1.0"
            },
            {
              "name": "controls",
              "ns": "https://oscalops.net/ns/library",
              "value": "1196"
            }
          ],
          "citation": {
            "text": "NIST OSCAL content, a work of the United States Government in the public domain within the United States, with copyright waived worldwide under CC0 1.0."
          },
          "rlinks": [
            {
              "href": "../NIST_SP-800-53_rev5_catalog.json",
              "media-type": "application/oscal+json",
              "hashes": [
                {
                  "algorithm": "sha-256",
                  "value": "1645df6a370dcb931db2e2d5d70c2f77bc89c38499a416c23a70eb2c0e595bcc"
                }
              ]
            },
            {
              "href": "https://raw.githubusercontent.com/usnistgov/oscal-content/v1.4.0/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json",
              "media-type": "application/oscal+json",
              "hashes": [
                {
                  "algorithm": "sha-256",
                  "value": "1645df6a370dcb931db2e2d5d70c2f77bc89c38499a416c23a70eb2c0e595bcc"
                }
              ]
            }
          ]
        },
        {
          "uuid": "e233b74e-8c37-54e5-a257-e03e7b65b40f",
          "title": "Debian 13 Password Hashing Component Definition",
          "description": "Passwords on Debian 13 (trixie) are stored as yescrypt hashes: a salted, memory-hard key derivation function. pam_unix hashes password changes made through PAM…",
          "props": [
            {
              "name": "version",
              "value": "1.0.0"
            },
            {
              "name": "library-item",
              "ns": "https://oscalops.net/ns/library",
              "value": "component-definition-version"
            },
            {
              "name": "artifact-slug",
              "ns": "https://oscalops.net/ns/library",
              "value": "debian-13-password-hashing"
            },
            {
              "name": "publication-status",
              "ns": "https://oscalops.net/ns/library",
              "value": "unpublished"
            },
            {
              "name": "assurance-state",
              "ns": "https://oscalops.net/ns/library",
              "value": "technically-tested"
            },
            {
              "name": "source-kind",
              "ns": "https://oscalops.net/ns/library",
              "value": "local"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-password-hashing/1.0.0/component-definition.json",
              "media-type": "application/oscal+json",
              "hashes": [
                {
                  "algorithm": "sha-256",
                  "value": "feb1718077387927fd85f1e85ab2b67b4495d03cabffdd02ff87d3d8daba38f2"
                }
              ]
            },
            {
              "href": "../../../../component-definitions/debian-13-password-hashing/1.0.0/index.html",
              "media-type": "text/html"
            }
          ]
        },
        {
          "uuid": "ee16f362-2b86-4dbd-9e25-c7be0d099b92",
          "title": "Verification script",
          "description": "Checks that pam_unix and /etc/login.defs select yescrypt; with --with-test-account, sets a password on a throwaway account and checks the stored hash is yescrypt. Configures nothing.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "shell-script"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-password-hashing/1.0.0/scripts/verify-password-hashing.sh",
              "media-type": "text/plain"
            }
          ]
        },
        {
          "uuid": "afd178e1-5b19-45b3-8179-db808eae36de",
          "title": "NIST SP 800-53 Rev 5 catalogue (oscal-content v1.4.0)",
          "description": "NIST SP 800-53 Revision 5 catalogue, release v1.4.0: the release this document's control identifiers resolve against.",
          "props": [
            {
              "name": "release-tag",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "v1.4.0"
            },
            {
              "name": "sha256",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "1645df6a370dcb931db2e2d5d70c2f77bc89c38499a416c23a70eb2c0e595bcc"
            }
          ],
          "rlinks": [
            {
              "href": "https://raw.githubusercontent.com/usnistgov/oscal-content/v1.4.0/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json",
              "media-type": "application/json"
            }
          ]
        },
        {
          "uuid": "f7d50635-1903-51f9-8ea6-dbbe6dcbf218",
          "title": "Debian 13 pam_pwquality Enforcement Base Component Definition",
          "description": "pam_pwquality installed on Debian 13 (trixie), stacked ahead of pam_unix, and set to reject rather than warn. It imposes no password rule of its own: each rule…",
          "props": [
            {
              "name": "version",
              "value": "1.0.0"
            },
            {
              "name": "library-item",
              "ns": "https://oscalops.net/ns/library",
              "value": "component-definition-version"
            },
            {
              "name": "artifact-slug",
              "ns": "https://oscalops.net/ns/library",
              "value": "debian-13-pwquality-base"
            },
            {
              "name": "publication-status",
              "ns": "https://oscalops.net/ns/library",
              "value": "unpublished"
            },
            {
              "name": "assurance-state",
              "ns": "https://oscalops.net/ns/library",
              "value": "technically-tested"
            },
            {
              "name": "source-kind",
              "ns": "https://oscalops.net/ns/library",
              "value": "local"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pwquality-base/1.0.0/component-definition.json",
              "media-type": "application/oscal+json",
              "hashes": [
                {
                  "algorithm": "sha-256",
                  "value": "ae4d53a9c860fc5db447dfba9e519a55d0972d48dfc9d27aeda0e256082692c8"
                }
              ]
            },
            {
              "href": "../../../../component-definitions/debian-13-pwquality-base/1.0.0/index.html",
              "media-type": "text/html"
            }
          ]
        },
        {
          "uuid": "972a2357-ac76-4414-862e-bfd204832bed",
          "title": "Verification script",
          "description": "Asserts that the stack enforces, that no maximum length or character-set restriction is imposed, and that this component owns its settings alone.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "shell-script"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pwquality-base/1.0.0/scripts/verify-pwquality-base.sh",
              "media-type": "text/plain"
            }
          ]
        },
        {
          "uuid": "9f9b89f2-ee5f-5ef6-b260-d3d5e2cb3177",
          "title": "Debian 13 ISM Dictionary Checking Component Definition",
          "description": "ism-2078 requires that commonly used or compromised passwords are not used. dictcheck evaluates every candidate against the cracklib dictionary from…",
          "props": [
            {
              "name": "version",
              "value": "1.0.0"
            },
            {
              "name": "library-item",
              "ns": "https://oscalops.net/ns/library",
              "value": "component-definition-version"
            },
            {
              "name": "artifact-slug",
              "ns": "https://oscalops.net/ns/library",
              "value": "debian-13-pwquality-dictionary"
            },
            {
              "name": "publication-status",
              "ns": "https://oscalops.net/ns/library",
              "value": "unpublished"
            },
            {
              "name": "assurance-state",
              "ns": "https://oscalops.net/ns/library",
              "value": "technically-tested"
            },
            {
              "name": "source-kind",
              "ns": "https://oscalops.net/ns/library",
              "value": "local"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pwquality-dictionary/1.0.0/component-definition.json",
              "media-type": "application/oscal+json",
              "hashes": [
                {
                  "algorithm": "sha-256",
                  "value": "7ed515bac345db836f2694bf636f164abbfcafca96f29d9f4a126188d6d12e1f"
                }
              ]
            },
            {
              "href": "../../../../component-definitions/debian-13-pwquality-dictionary/1.0.0/index.html",
              "media-type": "text/html"
            }
          ]
        },
        {
          "uuid": "71ac359d-3b86-4752-af35-7cad91128b5c",
          "title": "Verification script",
          "description": "Asserts the control from behaviour, with every candidate padded to the minimum length in force, and reports separately if another configuration sets a setting this component owns.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "shell-script"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pwquality-dictionary/1.0.0/scripts/verify-dictionary.sh",
              "media-type": "text/plain"
            }
          ]
        },
        {
          "uuid": "c6aaa027-2fa1-4d12-a806-c29641030292",
          "title": "debian-13-pwquality-base component-definition",
          "description": "The component this one depends on: pam_pwquality must be installed and enforcing, or nothing here is applied.",
          "document-ids": [
            {
              "scheme": "https://ns.oscalops.net/component-definitions",
              "identifier": "debian-13-pwquality-base"
            }
          ],
          "rlinks": [
            {
              "href": "https://library.oscalops.net/component-definitions/debian-13-pwquality-base/1.0.0/component-definition.json",
              "media-type": "application/json"
            }
          ]
        }
      ]
    }
  }
}