What
Add a password module that installs libpam-pwquality and writes /etc/security/pwquality.conf with sensible defaults (minlen=12, complexity requirements).
Why
Even with key-only SSH, passwords still matter for:
sudo authenticationsu to switch users- Console/VNC access from VPS provider dashboard
- Any PAM-authenticated service
A weak password on the deploy user means an attacker who gains any foothold can escalate via sudo.
Suggested implementation
Install libpam-pwquality and write config:
# /etc/security/pwquality.conf
minlen = 12
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1
enforce_for_root
Add verification: check that libpam-pwquality is installed and config file exists with expected minlen.
What
Add a
passwordmodule that installslibpam-pwqualityand writes/etc/security/pwquality.confwith sensible defaults (minlen=12, complexity requirements).Why
Even with key-only SSH, passwords still matter for:
sudoauthenticationsuto switch usersA weak password on the deploy user means an attacker who gains any foothold can escalate via
sudo.Suggested implementation
Install
libpam-pwqualityand write config:Add verification: check that
libpam-pwqualityis installed and config file exists with expectedminlen.