Not accredited. Assurance authority: none; self-asserted by the contributing author. Endorsement: none.
Theoretical component. It describes a configuration that satisfies the named controls when applied; it is not an assertion that any particular system is running it. An SSP leveraging this component must supply the implementation evidence for its own hosts.
Assurance state is 'technically-tested': the configuration was applied to a clean Debian 13 install and verified end to end. It has NOT been independently assessed, and is not endorsed or accredited by the ACSC, NIST, or any assessment authority.
Debian 13 ISM Dictionary Checking
ism-2078 requires that commonly used or compromised passwords are not used. dictcheck evaluates every candidate against the cracklib dictionary from cracklib-runtime, and badwords adds organisation-specific terms.
Partially implemented, and measured rather than assumed: the stock cracklib dictionary is a common-word corpus, not a breach-credential corpus. Depends on debian-13-pwquality-base.
Purpose. Reject commonly used passwords and organisation-specific terms on local Debian accounts.
Properties
| os-distribution | debian |
|---|
| os-release | 13 |
|---|
| os-codename | trixie |
|---|
| setting | pwquality:dictcheck |
|---|
| setting | pwquality:badwords |
|---|
The ISM prohibition on commonly used and compromised passwords, as published in the ACSC ISM OSCAL catalogue release v2026.09.4.
ISM-2078 — Password strength
Partially implemented. dictcheck = 1 evaluates every candidate against the cracklib dictionary, and badwords rejects organisation-specific terms.
Measured on a clean Debian 13 install, with candidates padded to at or above the minimum length in force so that length cannot be the reason for rejection: 1 of 8 common breach-list passwords was rejected at a 15-character minimum, and 2 of 8 at 20. The stock cracklib dictionary is a common-word corpus, not a breach-credential corpus, so the substantive requirement is not met by this configuration alone.
Residual risk Measured: only 1 of 8 long common passwords rejected at minlen 15. cracklib is not a breach-credential corpus.
Remarks
Close the residual by rebuilding the cracklib dictionary from a breach corpus with create-cracklib-dict(8) and pointing dictpath at the result, then re-running the verification script. The refresh cadence is the value bound to ia-05.01_odp.01.
Configuration and scripts
The SP 800-53 Rev 5 dictionary element, from oscal-content release v1.4.0.
IA-5(1) — Password-based Authentication
This component claims only IA-5(1)(a), the list of commonly used, expected or compromised passwords, and binds the parameter for how often that list is updated.
| Statement | Status | Description |
|---|
| (a) | partial | dictcheck = 1 evaluates candidates against the cracklib dictionary, and the refresh cadence is bound to ia-05.01_odp.01. Measured effectiveness is low: 1 of 8 long common passwords was rejected at minlen 15. cracklib is a common-word… |
| Parameter | Value |
|---|
ia-05.01_odp.01 | monthly, and immediately upon notification of a credential compromise affecting the system |
Configuration and scripts