Not accredited. Assurance authority: none; self-asserted by the contributing author. Endorsement: none.
Theoretical component. It describes a configuration that satisfies the named controls when applied; it is not an assertion that any particular system is running it. An SSP leveraging this component must supply the implementation evidence for its own hosts.
Assurance state is 'technically-tested': the configuration was applied to a clean Debian 13 install and verified end to end. It has NOT been independently assessed, and is not endorsed or accredited by the ACSC, NIST, or any assessment authority.
Debian 13 pam_pwquality enforcement base
pam_pwquality installed on Debian 13 (trixie), stacked ahead of pam_unix, and set to reject rather than warn. It imposes no password rule of its own: each rule is a component that owns its own settings and depends on this one.
A default-settings Debian 13 install has no pam_pwquality at all, so the effective floor is pam_unix's built-in 6 characters, and /etc/security/pwquality.conf ships entirely commented out.
Two controls are satisfied by omission here, because pam_pwquality imposes neither limit: no maximum length below 64 characters, and no character-set restriction.
Purpose. Provide the enforcement point every ISM password rule for Debian depends on, and evidence for the IA-5(1) elements that follow from it.
Properties
| os-distribution | debian |
|---|
| os-release | 13 |
|---|
| os-codename | trixie |
|---|
| setting | pam-auth-update:pwquality |
|---|
| setting | pwquality:enforcing |
|---|
| setting | pwquality:enforce_for_root |
|---|
| setting | pwquality:local_users_only |
|---|
| setting | pwquality:retry |
|---|
| package | libpam-pwquality |
|---|
| package-version | 1.4.5-5 |
|---|
| pam-stack-priority | 1024 (ahead of pam_unix at 256) |
|---|
| baseline-gap | stock Debian 13 enforces a 6-character floor via pam_unix |
|---|
ISM controls satisfied by pam_pwquality imposing no limit, as published in the ACSC ISM OSCAL catalogue release v2026.09.4.
| Control | Status | Applicability | Summary |
|---|
| ISM-2079 |
implemented | NC, OS, P, S, TS |
Implemented by omission. Neither pam_pwquality nor any drop-in in this family configures a maximum length, and pam_unix uses yescrypt, which does not truncate.… |
| ISM-2081 |
implemented | NC, OS, P, S, TS |
Implemented by omission. No character-set restriction is configured, and yescrypt accepts the full ASCII printable range including the space character. |
ISM-2079 — Password strength
Implemented by omission. Neither pam_pwquality nor any drop-in in this family configures a maximum length, and pam_unix uses yescrypt, which does not truncate. The effective ceiling is the PAM response buffer, far above the 64-character floor this control requires.
Verified: a 72-character passphrase is accepted by pwscore(1).
Configuration and scripts
ISM-2081 — Password strength
Implemented by omission. No character-set restriction is configured, and yescrypt accepts the full ASCII printable range including the space character.
Verified: a candidate interleaving every ASCII printable punctuation character with letters is accepted by pwscore(1). The punctuation set is interleaved because the unbroken set is itself a monotonic codepoint run, which a maxsequence rule correctly rejects.
Configuration and scripts
SP 800-53 Rev 5 elements that follow from the enforcement point itself, from oscal-content release v1.4.0.
IA-5(1) — Password-based Authentication
This component claims the IA-5(1) elements that follow from pam_pwquality being installed and enforcing: every password change is checked, long passphrases and the full printable character set are accepted, and password tooling is available. The content rules themselves are claimed by the rule components that own them.
| Statement | Status | Description |
|---|
| (b) | implemented | pam_pwquality runs as 'requisite' in the password stack, so every password creation and change is checked against the dictionary before pam_unix is reached. |
| (f) | implemented | No maximum length and no character-set restriction are configured, and yescrypt does not truncate. Long passphrases including spaces and the full ASCII printable range are accepted. Verified at 72 characters and across the ASCII printable… |
| (g) | implemented | libpwquality-tools provides pwmake(1), which generates high-entropy candidates, and pwscore(1), which scores a candidate against the live policy. Both are installed by the apply script. |
Configuration and scripts