(a) Maintain a list of commonly-used, expected, or compromised passwords and update the list [frequency] and when organizational passwords are suspected to have been compromised directly or indirectly;
(b) Verify, when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5(1)(a);
(c) Transmit passwords only over cryptographically-protected channels;
(d) Store passwords using an approved salted key derivation function, preferably using a keyed hash;
(e) Require immediate selection of a new password upon account recovery;
(f) Allow user selection of long passwords and passphrases, including spaces and all printable characters;
(g) Employ automated tools to assist the user in selecting strong password authenticators; and
(h) Enforce the following composition and complexity rules: [composition and complexity rules].
This component claims only IA-5(1)(d), password storage. The other elements of IA-5(1) are claimed by debian-13-pam-pwquality, or by no component; see debian-13-passphrase-hardening.
Statement
Status
Description
(d)
implemented
Passwords are stored using yescrypt, a salted, memory-hard key derivation function: pam_unix.so names yescrypt in /etc/pam.d/common-password, and /etc/login.defs sets ENCRYPT_METHOD YESCRYPT. Verified by inspecting the hash stored when a…
This component claims the IA-5(1) elements that follow from pam_pwquality being installed and enforcing: every password change is checked, long passphrases and the full printable character set are accepted, and password tooling is available. The content rules themselves are claimed by the rule components that own them.
Statement
Status
Description
(b)
implemented
pam_pwquality runs as 'requisite' in the password stack, so every password creation and change is checked against the dictionary before pam_unix is reached.
(f)
implemented
No maximum length and no character-set restriction are configured, and yescrypt does not truncate. Long passphrases including spaces and the full ASCII printable range are accepted. Verified at 72 characters and across the ASCII printable…
(g)
implemented
libpwquality-tools provides pwmake(1), which generates high-entropy candidates, and pwscore(1), which scores a candidate against the live policy. Both are installed by the apply script.
This component claims only IA-5(1)(a), the list of commonly used, expected or compromised passwords, and binds the parameter for how often that list is updated.
Statement
Status
Description
(a)
partial
dictcheck = 1 evaluates candidates against the cracklib dictionary, and the refresh cadence is bound to ia-05.01_odp.01. Measured effectiveness is low: 1 of 8 long common passwords was rejected at minlen 15. cracklib is a common-word…