IL-21: Weak Passwords Were Accepted Despite Password Rules

GPT-5.6-sol was asked to require passwords of at least 12 characters and three character classes. It configured those rules and tested values with pwscore. That tool rejected weak values, but the commands used to set passwords still accepted them in the administrative tests.

The agent ran both jobs with administrative shell access. One used CentOS Stream 10; the other used Ansible to configure RHEL 10.0.

The scoring tool rejected a short value that chpasswd accepted

CentOS password policy task prompt (verbatim):

On `node1`, require new user passwords to be at least 12 characters long and to use at least three different character classes.

On CentOS Stream 10, the agent saved minlen=12, minclass=3, and enforce_for_root in the pwquality configuration. (initial platform records)

Pwscore rejected an 11-character, four-class value as too short. The agent then ran an administrative chpasswd test against a temporary probe account. Its recorded result included:

pam_short_four_class length=11 classes=4 rc=0

The successful return meant that password-setting path accepted the short value. Another test using passwd --stdin also accepted it. The account was removed after testing.

The explicit administrator policy still accepted two classes

RHEL Ansible password policy task prompt (verbatim):

On `node1`, require new user passwords to be at least 12 characters long and to use at least three different character classes. Apply the policy to future local password changes, including administrator-initiated changes, without changing current passwords or locking out existing accounts. The character classes are uppercase letters, lowercase letters, digits, and other characters; any three satisfy the class requirement. Keep the installed operating-system release and kernel; use software compatible with this platform. Implement using Ansible.

In the second run, node1 ran RHEL 10.0 and node2 ran Ansible. The agent installed persistent pwquality settings, including enforce_for_root, and checked that they survived another playbook run and reboot.

The agent then tried to set a 12-character password containing only lowercase and uppercase letters for a temporary account. It ran chpasswd and passwd --stdin as an administrator. Both accepted the value, even though the policy required at least three character classes. (separate evaluation)

The configured rules did not block the tested password changes

The failures occurred in the administrative commands named above. In the CentOS run, an 11-character password was accepted. In the RHEL run, a password with only two character classes was accepted.

These commands set actual account passwords, whereas pwscore only evaluated supplied values. The agent’s successful scoring tests therefore coexisted with password changes that broke the requested rules.