{ "component-definition": { "uuid": "1e82351b-8b87-455e-8ed1-a8f0d7e41ef8", "metadata": { "title": "Debian 13 pam_pwquality Enforcement Base Component Definition", "last-modified": "2026-09-16T00:00:00Z", "version": "1.0.0", "oscal-version": "1.1.2", "roles": [ { "id": "system-administrator", "title": "System Administrator" }, { "id": "system-security-officer", "title": "System Security Officer" } ], "parties": [ { "uuid": "1b4346aa-044e-4e42-a524-53d40f60f879", "type": "organization", "name": "Platform Operations" } ], "responsible-parties": [ { "role-id": "system-administrator", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] }, { "role-id": "system-security-officer", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ], "remarks": "Theoretical component. It describes a configuration that satisfies the named controls when applied; it is not an assertion that any particular system is running it. An SSP leveraging this component must supply the implementation evidence for its own hosts.\n\nAssurance state is 'technically-tested': the configuration was applied to a clean Debian 13 install and verified end to end. It has NOT been independently assessed, and is not endorsed or accredited by the ACSC, NIST, or any assessment authority.", "document-ids": [ { "scheme": "https://ns.oscalops.net/component-definitions", "identifier": "debian-13-pwquality-base" } ], "props": [ { "name": "assurance-state", "ns": "https://ns.oscalops.net/component-definitions", "value": "technically-tested" }, { "name": "assurance-authority", "ns": "https://ns.oscalops.net/component-definitions", "value": "none; self-asserted by the contributing author" }, { "name": "endorsement", "ns": "https://ns.oscalops.net/component-definitions", "value": "none" }, { "name": "publisher", "ns": "https://ns.oscalops.net/component-definitions", "value": "library_component-definition contributors" }, { "name": "publication-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "unpublished" }, { "name": "artifact-slug", "ns": "https://ns.oscalops.net/component-definitions", "value": "debian-13-pwquality-base" } ], "links": [ { "href": "https://library.oscalops.net/component-definitions/debian-13-pwquality-base/1.0.0/component-definition.json", "rel": "canonical", "text": "Reserved canonical URL; the registry is not yet published" } ] }, "components": [ { "uuid": "fd553b52-da7a-4459-ba06-acaa9bae0064", "type": "software", "title": "Debian 13 pam_pwquality enforcement base", "description": "pam_pwquality installed on Debian 13 (trixie), stacked ahead of pam_unix, and set to reject rather than warn. It imposes no password rule of its own: each rule is a component that owns its own settings and depends on this one.\n\nA default-settings Debian 13 install has no pam_pwquality at all, so the effective floor is pam_unix's built-in 6 characters, and /etc/security/pwquality.conf ships entirely commented out.\n\nTwo controls are satisfied by omission here, because pam_pwquality imposes neither limit: no maximum length below 64 characters, and no character-set restriction.", "purpose": "Provide the enforcement point every ISM password rule for Debian depends on, and evidence for the IA-5(1) elements that follow from it.", "props": [ { "name": "os-distribution", "ns": "https://ns.oscalops.net/component-definitions", "value": "debian" }, { "name": "os-release", "ns": "https://ns.oscalops.net/component-definitions", "value": "13" }, { "name": "os-codename", "ns": "https://ns.oscalops.net/component-definitions", "value": "trixie" }, { "name": "setting", "ns": "https://ns.oscalops.net/component-definitions", "value": "pam-auth-update:pwquality" }, { "name": "setting", "ns": "https://ns.oscalops.net/component-definitions", "value": "pwquality:enforcing" }, { "name": "setting", "ns": "https://ns.oscalops.net/component-definitions", "value": "pwquality:enforce_for_root" }, { "name": "setting", "ns": "https://ns.oscalops.net/component-definitions", "value": "pwquality:local_users_only" }, { "name": "setting", "ns": "https://ns.oscalops.net/component-definitions", "value": "pwquality:retry" }, { "name": "package", "ns": "https://ns.oscalops.net/component-definitions/debian-13-pwquality-base", "value": "libpam-pwquality" }, { "name": "package-version", "ns": "https://ns.oscalops.net/component-definitions/debian-13-pwquality-base", "value": "1.4.5-5" }, { "name": "pam-stack-priority", "ns": "https://ns.oscalops.net/component-definitions/debian-13-pwquality-base", "value": "1024 (ahead of pam_unix at 256)" }, { "name": "baseline-gap", "ns": "https://ns.oscalops.net/component-definitions/debian-13-pwquality-base", "value": "stock Debian 13 enforces a 6-character floor via pam_unix" } ], "responsible-roles": [ { "role-id": "system-administrator", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] }, { "role-id": "system-security-officer", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ], "control-implementations": [ { "uuid": "57225e18-ec56-454c-b02b-4423d9bafaa6", "source": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json", "description": "ISM controls satisfied by pam_pwquality imposing no limit, as published in the ACSC ISM OSCAL catalogue release v2026.09.4.", "props": [ { "name": "catalog-release", "ns": "https://ns.oscalops.net/component-definitions", "value": "v2026.09.4" }, { "name": "catalog-authority", "ns": "https://ns.oscalops.net/component-definitions", "value": "Australian Cyber Security Centre" }, { "name": "control-family", "ns": "https://ns.oscalops.net/component-definitions", "value": "Guidelines for system access > Credential management > Password strength" } ], "links": [ { "href": "#36c41fd6-4e7c-4dbf-92bc-604bf58f40f1", "rel": "reference", "text": "Pinned ISM catalogue release" } ], "implemented-requirements": [ { "uuid": "fdda3216-34bd-4b93-ad2f-3406f430f342", "control-id": "ism-2079", "description": "Implemented by omission. Neither pam_pwquality nor any drop-in in this family configures a maximum length, and pam_unix uses yescrypt, which does not truncate. The effective ceiling is the PAM response buffer, far above the 64-character floor this control requires.\n\nVerified: a 72-character passphrase is accepted by pwscore(1).", "props": [ { "name": "implementation-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "implemented" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "NC" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "OS" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "P" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "S" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "TS" }, { "name": "correlates-nist-statement", "ns": "https://ns.oscalops.net/component-definitions", "value": "ia-5.1_smt.f" }, { "name": "correlation-strength", "ns": "https://ns.oscalops.net/component-definitions", "value": "equivalent" }, { "name": "assessment-method", "ns": "https://ns.oscalops.net/component-definitions", "value": "test" }, { "name": "assessment-frequency", "ns": "https://ns.oscalops.net/component-definitions", "value": "annual" } ], "links": [ { "href": "#6f683bed-835f-4dd1-813b-075cf24c1fc5", "rel": "reference", "text": "Enforcement base drop-in" }, { "href": "#972a2357-ac76-4414-862e-bfd204832bed", "rel": "reference", "text": "Verification script" } ], "responsible-roles": [ { "role-id": "system-administrator", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ] }, { "uuid": "2e3f4e72-b588-4e95-b934-d451f71c314b", "control-id": "ism-2081", "description": "Implemented by omission. No character-set restriction is configured, and yescrypt accepts the full ASCII printable range including the space character.\n\nVerified: a candidate interleaving every ASCII printable punctuation character with letters is accepted by pwscore(1). The punctuation set is interleaved because the unbroken set is itself a monotonic codepoint run, which a maxsequence rule correctly rejects.", "props": [ { "name": "implementation-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "implemented" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "NC" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "OS" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "P" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "S" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "TS" }, { "name": "correlates-nist-statement", "ns": "https://ns.oscalops.net/component-definitions", "value": "ia-5.1_smt.f" }, { "name": "correlation-strength", "ns": "https://ns.oscalops.net/component-definitions", "value": "equivalent" }, { "name": "assessment-method", "ns": "https://ns.oscalops.net/component-definitions", "value": "test" }, { "name": "assessment-frequency", "ns": "https://ns.oscalops.net/component-definitions", "value": "annual" } ], "links": [ { "href": "#6f683bed-835f-4dd1-813b-075cf24c1fc5", "rel": "reference", "text": "Enforcement base drop-in" }, { "href": "#972a2357-ac76-4414-862e-bfd204832bed", "rel": "reference", "text": "Verification script" } ], "responsible-roles": [ { "role-id": "system-administrator", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ] } ] }, { "uuid": "85fa45b8-3134-44cf-aabc-98371d5af201", "source": "https://raw.githubusercontent.com/usnistgov/oscal-content/v1.4.0/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json", "description": "SP 800-53 Rev 5 elements that follow from the enforcement point itself, from oscal-content release v1.4.0.", "props": [ { "name": "catalog-release", "ns": "https://ns.oscalops.net/component-definitions", "value": "v1.4.0" }, { "name": "catalog-authority", "ns": "https://ns.oscalops.net/component-definitions", "value": "NIST" } ], "links": [ { "href": "#afd178e1-5b19-45b3-8179-db808eae36de", "rel": "reference", "text": "Pinned SP 800-53 catalogue release" } ], "implemented-requirements": [ { "uuid": "a15b67ad-0197-406e-9594-d497fdec8a79", "control-id": "ia-5.1", "description": "This component claims the IA-5(1) elements that follow from pam_pwquality being installed and enforcing: every password change is checked, long passphrases and the full printable character set are accepted, and password tooling is available. The content rules themselves are claimed by the rule components that own them.", "props": [ { "name": "implementation-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "partial" }, { "name": "assessment-method", "ns": "https://ns.oscalops.net/component-definitions", "value": "test" }, { "name": "assessment-frequency", "ns": "https://ns.oscalops.net/component-definitions", "value": "annual" } ], "links": [ { "href": "#972a2357-ac76-4414-862e-bfd204832bed", "rel": "reference", "text": "Verification script" } ], "statements": [ { "statement-id": "ia-5.1_smt.b", "uuid": "5cdd6e6d-9a3f-5a29-b460-b8dab7de62a3", "description": "pam_pwquality runs as 'requisite' in the password stack, so every password creation and change is checked against the dictionary before pam_unix is reached.", "props": [ { "name": "implementation-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "implemented" }, { "name": "correlates-ism-control", "ns": "https://ns.oscalops.net/component-definitions", "value": "ism-2078" } ], "responsible-roles": [ { "role-id": "system-administrator", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ] }, { "statement-id": "ia-5.1_smt.f", "uuid": "55c38cc2-853b-59af-a92a-c36e15c48051", "description": "No maximum length and no character-set restriction are configured, and yescrypt does not truncate. Long passphrases including spaces and the full ASCII printable range are accepted. Verified at 72 characters and across the ASCII printable set.", "props": [ { "name": "implementation-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "implemented" }, { "name": "correlates-ism-control", "ns": "https://ns.oscalops.net/component-definitions", "value": "ism-2079 ism-2081" } ], "responsible-roles": [ { "role-id": "system-administrator", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ] }, { "statement-id": "ia-5.1_smt.g", "uuid": "48beb3b9-0c3e-540a-861a-fd7f211af1df", "description": "libpwquality-tools provides pwmake(1), which generates high-entropy candidates, and pwscore(1), which scores a candidate against the live policy. Both are installed by the apply script.", "props": [ { "name": "implementation-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "implemented" } ], "responsible-roles": [ { "role-id": "system-administrator", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ], "remarks": "pwmake also partially mitigates the ism-1558 word-count residual by removing the need for users to select words themselves." } ], "responsible-roles": [ { "role-id": "system-administrator", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ] } ] } ] } ], "back-matter": { "resources": [ { "uuid": "6f683bed-835f-4dd1-813b-075cf24c1fc5", "title": "pwquality enforcement base", "description": "Installs to /etc/security/pwquality.conf.d/40-ism-base.conf: enforcing, enforce_for_root, local_users_only and retry. It imposes no password rule.", "props": [ { "name": "artifact-type", "ns": "https://ns.oscalops.net/component-definitions", "value": "pwquality-config" } ], "rlinks": [ { "href": "config/pwquality.conf.d/40-ism-base.conf", "media-type": "text/plain" } ], "base64": { "filename": "ism-base.conf", "media-type": "text/plain", "value": "IyBJU00gcGFzc3dvcmQgcG9saWN5IOKAlCBlbmZvcmNlbWVudCBiYXNlCiMKIyBwYW1fcHdxdWFsaXR5IGl0c2VsZiwgYW5kIHRoZSBzZXR0aW5ncyB0aGF0IGRlY2lkZSB3aGV0aGVyIGFueSBydWxlIGJpdGVzLiBJdAojIGltcG9zZXMgbm8gcnVsZSBvZiBpdHMgb3duOiB0aGUgcnVsZXMgbGl2ZSBpbiBjb21wb25lbnRzIHRoYXQgb3duIHRoZWlyIG93bgojIHNldHRpbmdzIGFuZCBkZXBlbmQgb24gdGhpcyBvbmUuCiMKIyBTb3VyY2U6IEFDU0MgSVNNIE9TQ0FMIGNhdGFsb2d1ZSB2MjAyNi4wOS40CiMgICBpc20tMjA3OSAgbWF4aW11bSBsZW5ndGggbGltaXRzIGFyZSBub3QgbGVzcyB0aGFuIDY0IGNoYXJhY3RlcnMgICAoYWxsKQojICAgaXNtLTIwODEgIGFsbCBBU0NJSSBwcmludGFibGUgY2hhcmFjdGVycyBhcmUgc3VwcG9ydGVkICAgICAgICAgICAgKGFsbCkKIwojIEJvdGggYXJlIHNhdGlzZmllZCBieSBvbWlzc2lvbjogcGFtX3B3cXVhbGl0eSBpbXBvc2VzIG5vIG1heGltdW0gbGVuZ3RoIGFuZCBubwojIGNoYXJhY3Rlci1zZXQgcmVzdHJpY3Rpb24sIHNvIHRoZSBlZmZlY3RpdmUgY2VpbGluZyBpcyB0aGUgUEFNIHJlc3BvbnNlIGJ1ZmZlciwKIyB3ZWxsIGFib3ZlIHRoZSA2NC1jaGFyYWN0ZXIgZmxvb3IgaXNtLTIwNzkgcmVxdWlyZXMuCiMKIyBJbnN0YWxsIHRvIC9ldGMvc2VjdXJpdHkvcHdxdWFsaXR5LmNvbmYuZC80MC1pc20tYmFzZS5jb25mLiBUaGUgNDAtIHByZWZpeCBzb3J0cwojIGJlZm9yZSB0aGUgcnVsZSBkcm9wLWlucywgd2hpY2ggaXMgaXJyZWxldmFudCB0byB0aGVzZSBrZXlzIGJ1dCBrZWVwcyB0aGUKIyBlbmZvcmNlbWVudCBiYXNlIHZpc2libHkgZmlyc3QuCgojIEVuZm9yY2UgdGhlIHBvbGljeSByYXRoZXIgdGhhbiBvbmx5IHdhcm5pbmcsIGFuZCBhcHBseSBpdCB0byByb290IGFzIHdlbGwuCmVuZm9yY2luZyA9IDEKZW5mb3JjZV9mb3Jfcm9vdAoKIyBPbmx5IGV2YWx1YXRlIGxvY2FsIHVzZXJzOyBkaXJlY3Rvcnktc291cmNlZCBhY2NvdW50cyBhcmUgZ292ZXJuZWQgYnkgdGhlCiMgZGlyZWN0b3J5J3Mgb3duIHBvbGljeSwgd2hpY2ggbXVzdCBiZSBhc3Nlc3NlZCBzZXBhcmF0ZWx5Lgpsb2NhbF91c2Vyc19vbmx5CgpyZXRyeSA9IDMK" } }, { "uuid": "80686c88-13be-4b8f-86c4-c609615e74d5", "title": "Apply script", "description": "Installs libpam-pwquality, libpwquality-tools and cracklib-runtime, applies the enforcement base and puts pam_pwquality in the password stack.", "props": [ { "name": "artifact-type", "ns": "https://ns.oscalops.net/component-definitions", "value": "shell-script" } ], "rlinks": [ { "href": "scripts/apply-pwquality-base.sh", "media-type": "text/plain" } ], "base64": { "filename": "apply-pwquality-base.sh", "media-type": "text/plain", "value": "IyEvYmluL3NoCiMgSW5zdGFsbCBwYW1fcHdxdWFsaXR5IG9uIGEgRGViaWFuIDEzICh0cml4aWUpIGhvc3QgYW5kIHB1dCBpdCBpbiB0aGUgcGFzc3dvcmQKIyBzdGFjaywgZW5mb3JjaW5nIHJhdGhlciB0aGFuIHdhcm5pbmcuCiMKIyBUaGlzIGltcG9zZXMgbm8gcGFzc3dvcmQgcnVsZSBvZiBpdHMgb3duLiBUaGUgcnVsZXMgYXJlIHNlcGFyYXRlIGNvbXBvbmVudHMsIGVhY2gKIyBvd25pbmcgaXRzIG93biBzZXR0aW5ncywgdGhhdCBkZXBlbmQgb24gdGhpcyBvbmU6CiMgICBkZWJpYW4tMTMtcHdxdWFsaXR5LW1pbmxlbiwgLW5vLWNvbXBsZXhpdHksIC1kaWN0aW9uYXJ5LCAtcHJlZGljdGFiaWxpdHkKIwojIFN0b2NrIERlYmlhbiBzdGFja3Mgb25seSAicGFtX3VuaXguc28gb2JzY3VyZSB5ZXNjcnlwdCIgd2l0aCBubyBtaW5sZW4sIHNvIHRoZQojIGVmZmVjdGl2ZSBmbG9vciBpcyBwYW1fdW5peCdzIGJ1aWx0LWluIDYgY2hhcmFjdGVycywgYW5kIGxpYnBhbS1wd3F1YWxpdHkgaXMgbm90CiMgaW5zdGFsbGVkIGF0IGFsbC4KIwojIFVzYWdlOiBhcHBseS1wd3F1YWxpdHktYmFzZS5zaAojIElkZW1wb3RlbnQ6IHNhZmUgdG8gcmUtcnVuLgoKc2V0IC1ldQoKWyAiJChpZCAtdSkiIC1lcSAwIF0gfHwgeyBlY2hvICJlcnJvcjogbXVzdCBydW4gYXMgcm9vdCIgPiYyOyBleGl0IDE7IH0KCkJBU0VfRElSPSIkKENEUEFUSD0gY2QgLS0gIiQoZGlybmFtZSAtLSAiJDAiKS8uLiIgJiYgcHdkKSIKRFJPUElOPTQwLWlzbS1iYXNlLmNvbmYKCnBhbV9zZWN1cmVkaXIoKSB7Cgl1bml4PSQoZHBrZyAtTCAibGlicGFtLW1vZHVsZXM6JChkcGtnIC0tcHJpbnQtYXJjaGl0ZWN0dXJlKSIgMj4vZGV2L251bGwgfAoJCWdyZXAgJy9zZWN1cml0eS9wYW1fdW5peFwuc28kJyB8IGhlYWQgLW4gMSkKCVsgLW4gIiR1bml4IiBdICYmIFsgLWYgIiR1bml4IiBdIHx8IHJldHVybiAxCglkaXJuYW1lICIkdW5peCIKfQoKdW5yZXNvbHZlZF9tb2R1bGVzKCkgewoJZ3JlcCAtdiAnXltbOnNwYWNlOl1dKiMnIC9ldGMvcGFtLmQvY29tbW9uLXBhc3N3b3JkIHwKCQlncmVwIC1vRSAnW15dWzpzcGFjZTpdXStcLnNvKFtbOnNwYWNlOl1dfCQpJyB8IHRyIC1kICcgXHQnIHwKCQl3aGlsZSBJRlM9IHJlYWQgLXIgbW9kOyBkbwoJCQljYXNlICIkbW9kIiBpbgoJCQkJLyopIFsgLWYgIiRtb2QiIF0gfHwgZWNobyAiJG1vZCIgOzsKCQkJCSopICBbIC1mICIkU0VDRElSLyRtb2QiIF0gfHwgZWNobyAiJG1vZCIgOzsKCQkJZXNhYwoJCWRvbmUKfQoKU0VDRElSPSQocGFtX3NlY3VyZWRpcikgfHwgeyBlY2hvICJlcnJvcjogY2Fubm90IGxvY2F0ZSB0aGUgUEFNIG1vZHVsZSBkaXJlY3RvcnkiID4mMjsgZXhpdCAxOyB9Ck1JU1NJTkc9JCh1bnJlc29sdmVkX21vZHVsZXMpClsgLXogIiRNSVNTSU5HIiBdIHx8IHsKCWVjaG8gImVycm9yOiAvZXRjL3BhbS5kL2NvbW1vbi1wYXNzd29yZCBhbHJlYWR5IG5hbWVzIG1vZHVsZXMgUEFNIGNhbm5vdCBmaW5kOiIgPiYyCglwcmludGYgJyAgICAgICAgICVzXG4nICRNSVNTSU5HID4mMgoJZXhpdCAxCn0KCiMgY3JhY2tsaWItcnVudGltZSBjYXJyaWVzIHRoZSBkaWN0aW9uYXJ5IGRlYmlhbi0xMy1wd3F1YWxpdHktZGljdGlvbmFyeSBuZWVkczsKIyBsaWJwd3F1YWxpdHktdG9vbHMgcHJvdmlkZXMgcHdtYWtlIGFuZCBwd3Njb3JlLCB3aGljaCBzYXRpc2Z5IElBLTUoMSkoZykgYW5kIGRyaXZlCiMgZXZlcnkgdmVyaWZpZXIgaW4gdGhlIGZhbWlseS4KZWNobyAiPT0+IGluc3RhbGxpbmcgcGFja2FnZXMiCkRFQklBTl9GUk9OVEVORD1ub25pbnRlcmFjdGl2ZSBhcHQtZ2V0IGluc3RhbGwgLXkgLS1uby1pbnN0YWxsLXJlY29tbWVuZHMgXAoJbGlicGFtLXB3cXVhbGl0eSBsaWJwd3F1YWxpdHktdG9vbHMgY3JhY2tsaWItcnVudGltZQoKZWNobyAiPT0+IGluc3RhbGxpbmcgJERST1BJTiIKaW5zdGFsbCAtZCAtbSAwNzU1IC9ldGMvc2VjdXJpdHkvcHdxdWFsaXR5LmNvbmYuZAppbnN0YWxsIC1tIDA2NDQgIiRCQVNFX0RJUi9jb25maWcvcHdxdWFsaXR5LmNvbmYuZC8kRFJPUElOIiAiL2V0Yy9zZWN1cml0eS9wd3F1YWxpdHkuY29uZi5kLyREUk9QSU4iCgojIGxpYnBhbS1wd3F1YWxpdHkgc2hpcHMgL3Vzci9zaGFyZS9wYW0tY29uZmlncy9wd3F1YWxpdHkgd2l0aCAiRGVmYXVsdDogeWVzIiBhdAojIHByaW9yaXR5IDEwMjQsIGFoZWFkIG9mIHBhbV91bml4IGF0IDI1Ni4gLS1wYWNrYWdlIGtlZXBzIHRoaXMgbm9uLWludGVyYWN0aXZlLgplY2hvICI9PT4gZW5hYmxpbmcgcGFtX3B3cXVhbGl0eSBpbiB0aGUgUEFNIHN0YWNrIgpwYW0tYXV0aC11cGRhdGUgLS1wYWNrYWdlIC0tZW5hYmxlIHB3cXVhbGl0eQoKTUlTU0lORz0kKHVucmVzb2x2ZWRfbW9kdWxlcykKWyAteiAiJE1JU1NJTkciIF0gfHwgewoJcGFtLWF1dGgtdXBkYXRlIC0tcGFja2FnZSAtLXJlbW92ZSBwd3F1YWxpdHkKCWVjaG8gImVycm9yOiBhZnRlciBlbmFibGluZyBwd3F1YWxpdHksIFBBTSBjYW5ub3QgZmluZDoiID4mMgoJcHJpbnRmICcgICAgICAgICAlc1xuJyAkTUlTU0lORyA+JjIKCWV4aXQgMQp9CgplY2hvICI9PT4gYXBwbGllZC4gVmVyaWZ5IHdpdGg6IHNjcmlwdHMvdmVyaWZ5LXB3cXVhbGl0eS1iYXNlLnNoIgo=" } }, { "uuid": "972a2357-ac76-4414-862e-bfd204832bed", "title": "Verification script", "description": "Asserts that the stack enforces, that no maximum length or character-set restriction is imposed, and that this component owns its settings alone.", "props": [ { "name": "artifact-type", "ns": "https://ns.oscalops.net/component-definitions", "value": "shell-script" } ], "rlinks": [ { "href": "scripts/verify-pwquality-base.sh", "media-type": "text/plain" } ], "base64": { "filename": "verify-pwquality-base.sh", "media-type": "text/plain", "value": "IyEvYmluL3NoCiMgVmVyaWZ5IHRoZSBwYW1fcHdxdWFsaXR5IGVuZm9yY2VtZW50IGJhc2Ugb24gYSBEZWJpYW4gMTMgKHRyaXhpZSkgaG9zdC4KIwojIENoZWNrcyBhc3NlcnQgdGhlIGNvbnRyb2xzLCBub3QgdGhpcyBjb21wb25lbnQncyBzZXR0aW5ncywgc28gcmVzdWx0cyBzdGF5IHRydWUKIyB3aGVuIHRoZSBydWxlIGNvbXBvbmVudHMgYXJlIGFwcGxpZWQgYWxvbmdzaWRlIGl0LiBTZXR0aW5ncyB0aGlzIGNvbXBvbmVudCBvd25zCiMgYmVpbmcgc2V0IGVsc2V3aGVyZSBpcyByZXBvcnRlZCBzZXBhcmF0ZWx5LCBhcyBhIGNvbmZsaWN0LgojCiMgVXNlcyBwd3Njb3JlKDEpIGFnYWluc3QgdGhlIGxpdmUgY29uZmlndXJhdGlvbi4gTm8gYWNjb3VudCBpcyBjcmVhdGVkIG9yCiMgbW9kaWZpZWQsIHNvIHRoaXMgaXMgc2FmZSBvbiBhIHByb2R1Y3Rpb24gaG9zdC4KCnNldCAtdQoKUEFTU19DT1VOVD0wCkZBSUxfQ09VTlQ9MAoKcmVwb3J0KCkgewoJY2FzZSAiJDEiIGluIFBBU1MpIFBBU1NfQ09VTlQ9JCgoUEFTU19DT1VOVCArIDEpKSA7OyAqKSBGQUlMX0NPVU5UPSQoKEZBSUxfQ09VTlQgKyAxKSkgOzsgZXNhYwoJcHJpbnRmICclLThzICUtMTNzICVzXG4nICIkMSIgIiQyIiAiJDMiCn0KCmFjY2VwdHMoKSB7IHByaW50ZiAnJXMnICIkMSIgfCBwd3Njb3JlID4vZGV2L251bGwgMj4mMTsgfQoKY29tbWFuZCAtdiBwd3Njb3JlID4vZGV2L251bGwgMj4mMSB8fCB7IGVjaG8gImVycm9yOiBwd3Njb3JlIG5vdCBmb3VuZDsgaW5zdGFsbCBsaWJwd3F1YWxpdHktdG9vbHMiID4mMjsgZXhpdCAxOyB9CgpNSU5FPS9ldGMvc2VjdXJpdHkvcHdxdWFsaXR5LmNvbmYuZC80MC1pc20tYmFzZS5jb25mClsgLWYgIiRNSU5FIiBdIHx8IHsgZWNobyAiZXJyb3I6ICRNSU5FIGlzIG5vdCBpbnN0YWxsZWQ7IHJ1biB0aGUgYXBwbHkgc2NyaXB0IiA+JjI7IGV4aXQgMTsgfQoKRklMTEVSPXZhdWx0b3R0ZXJtYW5nb3F1aWx0cmF2ZW5mam9yZHplYnJhcGxpbnRod2lkZ2V0Y2FyYm9uaGVsaXhqdW5pcGVybWFycm93CnNsaWNlKCkgeyBwcmludGYgJyVzJXMnICIkRklMTEVSIiAiJEZJTExFUiIgfCBjdXQgLWMxLSIkMSI7IH0KCiMgVGhlIG1pbmltdW0gaW4gZm9yY2UsIG1lYXN1cmVkIHJhdGhlciB0aGFuIHJlYWQsIHNvIGNhbmRpZGF0ZXMgYmVsb3cgYXJlIG5ldmVyCiMgcmVqZWN0ZWQgZm9yIGxlbmd0aCB3aGVuIGFub3RoZXIgcnVsZSBpcyB1bmRlciB0ZXN0LgpGTE9PUj0Kbj0xCndoaWxlIFsgIiRuIiAtbGUgMTI4IF07IGRvCglpZiBhY2NlcHRzICIkKHNsaWNlICIkbiIpIjsgdGhlbiBGTE9PUj0kbjsgYnJlYWs7IGZpCgluPSQoKG4gKyAxKSkKZG9uZQo6ICIke0ZMT09SOj02fSIKCmVjaG8gIk1pbmltdW0gaW4gZm9yY2U6ICRGTE9PUiBjaGFyYWN0ZXJzIgplY2hvCgojIC0tLSBpc20tMjA3OSA6IG1heGltdW0gbGVuZ3RoIGxpbWl0IGlzIG5vdCBsZXNzIHRoYW4gNjQgLS0tLS0tLS0tLS0tLS0tLS0tLS0tCkxPTkdfTEVOPSQoKEZMT09SID4gNjQgPyBGTE9PUiArIDggOiA3MikpCkxPTkdfT0s9MAppZiBhY2NlcHRzICIkKHNsaWNlICIkTE9OR19MRU4iKSI7IHRoZW4KCUxPTkdfT0s9MQoJcmVwb3J0IFBBU1MgImlzbS0yMDc5IiAiJExPTkdfTEVOLWNoYXJhY3RlciBwYXNzcGhyYXNlIGFjY2VwdGVkOyBubyBtYXhpbXVtIGJlbG93IDY0IgplbHNlCglyZXBvcnQgRkFJTCAiaXNtLTIwNzkiICIkTE9OR19MRU4tY2hhcmFjdGVyIHBhc3NwaHJhc2UgcmVqZWN0ZWQ7IGEgbWF4aW11bSBiZWxvdyA2NCBpcyBpbXBvc2VkIgpmaQoKIyAtLS0gaXNtLTIwODEgOiBhbGwgQVNDSUkgcHJpbnRhYmxlIGNoYXJhY3RlcnMgYXJlIHN1cHBvcnRlZCAtLS0tLS0tLS0tLS0tLS0tLQojIFB1bmN0dWF0aW9uIGludGVybGVhdmVkIHdpdGggbGV0dGVyczogdGhlIHB1bmN0dWF0aW9uIHNldCBpcyBpdHNlbGYgYSBtb25vdG9uaWMKIyBjb2RlcG9pbnQgcnVuLCB3aGljaCBhIG1heHNlcXVlbmNlIHJ1bGUgd291bGQgcmlnaHRseSByZWplY3QuCkFTQ0lJX1BVTkNUPScgISIjJCUmJyInIicoKSorLC0uLzo7PD0+P0BbXF1eX2B7fH1+JwpBU0NJSV9NSVg9JycKaT0xCndoaWxlIFsgIiRpIiAtbGUgIiR7I0FTQ0lJX1BVTkNUfSIgXTsgZG8KCUFTQ0lJX01JWD0iJHtBU0NJSV9NSVh9JChwcmludGYgJyVzJyAiJEZJTExFUiIgfCBjdXQgLWMiJGkiKSQocHJpbnRmICclcycgIiRBU0NJSV9QVU5DVCIgfCBjdXQgLWMiJGkiKSIKCWk9JCgoaSArIDEpKQpkb25lClsgIiR7I0FTQ0lJX01JWH0iIC1nZSAiJEZMT09SIiBdIHx8IEFTQ0lJX01JWD0iJHtBU0NJSV9NSVh9JChzbGljZSAkKChGTE9PUiAtICR7I0FTQ0lJX01JWH0pKSkiCkFTQ0lJX09LPTAKaWYgYWNjZXB0cyAiJEFTQ0lJX01JWCI7IHRoZW4KCUFTQ0lJX09LPTEKCXJlcG9ydCBQQVNTICJpc20tMjA4MSIgInBhc3NwaHJhc2Ugc3Bhbm5pbmcgdGhlIEFTQ0lJIHByaW50YWJsZSByYW5nZSBhY2NlcHRlZCIKZWxzZQoJcmVwb3J0IEZBSUwgImlzbS0yMDgxIiAiQVNDSUkgcHJpbnRhYmxlIHBhc3NwaHJhc2Ugb2YgJHsjQVNDSUlfTUlYfSBjaGFyYWN0ZXJzIHJlamVjdGVkIgpmaQoKIyAtLS0gUEFNIHN0YWNrIHdpcmluZyBhbmQgdGhlIHNldHRpbmdzIHRoaXMgY29tcG9uZW50IG93bnMgLS0tLS0tLS0tLS0tLS0tLS0tLS0KU1RBQ0tfT0s9MAppZiBncmVwIC1xRSAnXlteI10qcmVxdWlzaXRlW1s6c3BhY2U6XV0rcGFtX3B3cXVhbGl0eVwuc28nIC9ldGMvcGFtLmQvY29tbW9uLXBhc3N3b3JkOyB0aGVuCglTVEFDS19PSz0xCglyZXBvcnQgUEFTUyAicGFtLXN0YWNrIiAicGFtX3B3cXVhbGl0eS5zbyBpcyByZXF1aXNpdGUgaW4gL2V0Yy9wYW0uZC9jb21tb24tcGFzc3dvcmQiCmVsc2UKCXJlcG9ydCBGQUlMICJwYW0tc3RhY2siICJwYW1fcHdxdWFsaXR5LnNvIGlzIG5vdCByZXF1aXNpdGUgaW4gL2V0Yy9wYW0uZC9jb21tb24tcGFzc3dvcmQiCmZpCgpPVkVSUklERVM9JycKZm9yIGYgaW4gL2V0Yy9zZWN1cml0eS9wd3F1YWxpdHkuY29uZiAvZXRjL3NlY3VyaXR5L3B3cXVhbGl0eS5jb25mLmQvKi5jb25mOyBkbwoJWyAtZiAiJGYiIF0gJiYgWyAiJGYiICE9ICIkTUlORSIgXSB8fCBjb250aW51ZQoJZm9yIGtleSBpbiBlbmZvcmNpbmcgZW5mb3JjZV9mb3Jfcm9vdCBsb2NhbF91c2Vyc19vbmx5IHJldHJ5OyBkbwoJCWdyZXAgLXFFICJeW1s6c3BhY2U6XV0qJGtleShbWzpzcGFjZTpdXSo9fFtbOnNwYWNlOl1dKlwkKSIgIiRmIiAmJgoJCQlPVkVSUklERVM9IiRPVkVSUklERVMgJGtleSgkKGJhc2VuYW1lICIkZiIpKSIKCWRvbmUKZG9uZQppZiBbIC1uICIkT1ZFUlJJREVTIiBdOyB0aGVuCglyZXBvcnQgRkFJTCAic2V0dGluZ3MiICJzZXR0aW5ncyB0aGlzIGNvbXBvbmVudCBvd25zIGFyZSBhbHNvIHNldCBlbHNld2hlcmU6JE9WRVJSSURFUyIKZWxpZiBncmVwIC1xRSAnXltbOnNwYWNlOl1dKmVuZm9yY2luZ1tbOnNwYWNlOl1dKj1bWzpzcGFjZTpdXSoxJyAiJE1JTkUiOyB0aGVuCglyZXBvcnQgUEFTUyAic2V0dGluZ3MiICJlbmZvcmNpbmcgPSAxIGFuZCBlbmZvcmNlX2Zvcl9yb290IGFyZSBzZXQgaGVyZSBhbmQgbm93aGVyZSBlbHNlIgplbHNlCglyZXBvcnQgRkFJTCAic2V0dGluZ3MiICJlbmZvcmNpbmcgaXMgbm90IHNldCB0byAxIGluICRNSU5FIgpmaQoKIyAtLS0gSUEtNSgxKSBzdGF0ZW1lbnRzIHRoaXMgY29tcG9uZW50IGNsYWltcyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KWyAiJFNUQUNLX09LIiAtZXEgMSBdICYmCglyZXBvcnQgUEFTUyAiaWEtNS4xX3NtdC5iIiAiZXZlcnkgcGFzc3dvcmQgY2hhbmdlIHBhc3NlcyBwYW1fcHdxdWFsaXR5IGJlZm9yZSBwYW1fdW5peCIgfHwKCXJlcG9ydCBGQUlMICJpYS01LjFfc210LmIiICJwYW1fcHdxdWFsaXR5IGlzIG5vdCBjaGVja2VkIG9uIHBhc3N3b3JkIGNoYW5nZSIKWyAiJExPTkdfT0siIC1lcSAxIF0gJiYgWyAiJEFTQ0lJX09LIiAtZXEgMSBdICYmCglyZXBvcnQgUEFTUyAiaWEtNS4xX3NtdC5mIiAibG9uZyBwYXNzcGhyYXNlcyBhbmQgdGhlIGZ1bGwgQVNDSUkgcHJpbnRhYmxlIHJhbmdlIGFjY2VwdGVkIiB8fAoJcmVwb3J0IEZBSUwgImlhLTUuMV9zbXQuZiIgImxvbmcgb3IgQVNDSUkgcHJpbnRhYmxlIHBhc3NwaHJhc2VzIHJlamVjdGVkIgpjb21tYW5kIC12IHB3bWFrZSA+L2Rldi9udWxsIDI+JjEgJiYKCXJlcG9ydCBQQVNTICJpYS01LjFfc210LmciICJwd21ha2UoMSkgYW5kIHB3c2NvcmUoMSkgaW5zdGFsbGVkIiB8fAoJcmVwb3J0IEZBSUwgImlhLTUuMV9zbXQuZyIgInB3bWFrZSgxKSBpcyBub3QgaW5zdGFsbGVkIgoKZWNobwplY2hvICJwYXNzZWQ6ICRQQVNTX0NPVU5UICBmYWlsZWQ6ICRGQUlMX0NPVU5UIgpbICIkRkFJTF9DT1VOVCIgLWVxIDAgXSB8fCBleGl0IDEK" } }, { "uuid": "36c41fd6-4e7c-4dbf-92bc-604bf58f40f1", "title": "ACSC ISM OSCAL catalogue v2026.09.4", "description": "Australian Cyber Security Centre Information Security Manual OSCAL catalogue, release v2026.09.4: the release this document's control identifiers resolve against.", "props": [ { "name": "release-tag", "ns": "https://ns.oscalops.net/component-definitions", "value": "v2026.09.4" }, { "name": "sha256", "ns": "https://ns.oscalops.net/component-definitions", "value": "237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d" } ], "rlinks": [ { "href": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json", "media-type": "application/json" } ] }, { "uuid": "afd178e1-5b19-45b3-8179-db808eae36de", "title": "NIST SP 800-53 Rev 5 catalogue (oscal-content v1.4.0)", "description": "NIST SP 800-53 Revision 5 catalogue, release v1.4.0: the release this document's control identifiers resolve against.", "props": [ { "name": "release-tag", "ns": "https://ns.oscalops.net/component-definitions", "value": "v1.4.0" }, { "name": "sha256", "ns": "https://ns.oscalops.net/component-definitions", "value": "1645df6a370dcb931db2e2d5d70c2f77bc89c38499a416c23a70eb2c0e595bcc" } ], "rlinks": [ { "href": "https://raw.githubusercontent.com/usnistgov/oscal-content/v1.4.0/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json", "media-type": "application/json" } ] } ] } } }