Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide

The Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide (V1 R2) has 391 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

391STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Wed Sep 30 2026

TOSS 5 must ensure the password complexity module is enabled in the password-auth file.

Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide

Assessment Title

Rule Text

TOSS 5 must ensure the password complexity module is enabled in the password-auth file.

Description

Discussion Text

Enabling PAM password complexity permits enforcement of strong passwords and consequently makes the system less prone to dictionary attacks.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-282446

Rule

SV-282446r1200318_rule

Severity

high

Rule Version

TOSS-05-000334

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify TOSS 5 uses "pwquality" to enforce the password complexity rules in the "password-auth" file using the following command:

$ cat /etc/pam.d/password-auth | grep pam_pwquality

password required pam_pwquality.so 

If the command does not return a line containing the value "pam_pwquality.so", or the line is commented out, this is a finding.

Implementation Procedure

Fix Text

Configure TOSS 5 to use "pwquality" to enforce password complexity rules.

Add the following line to the "/etc/pam.d/password-auth" file (or modify the line to have the required value):

password required pam_pwquality.so

STIG check 94 of 391 in the Tri-Lab Operating System Stack (TOSS) 5 STIG checklist

← Previous · V-282445TOSS 5 must ensure the password complexity module in the system-auth file is configured for three retries or less.Next · V-282447 →TOSS 5 must enforce password complexity by requiring at least one uppercase character.