Detections
Analytics

5.3.2.3 Ensure pam_pwquality module is enabled

Information

The pam_pwquality.so module performs password quality checking. This module can be plugged into the password stack of a given service to provide strength-checking for passwords. The code was originally based on pam_cracklib module and the module is backwards compatible with its options.

The action of this module is to prompt the user for a password and check its strength against a system dictionary and a set of rules for identifying poor choices.

The first action is to prompt for a single password, check its strength and then, if it is considered strong, prompt for the password a second time (to verify that it was typed correctly on the first occasion). All being well, the password is passed on to subsequent modules to be installed as the new authentication token.

Use of a unique, complex passwords helps to increase the time and resources required to compromise the password.

Solution

pam_pwquality is part of the default authselect profiles, so a system using a default profile already provides it.

On a system already managed by an authselect profile, ensure the active profile includes pam_pwquality:

 - The default profiles include it; no change is required.
 - If a custom profile has removed it, add the following line to the custom profile's system-auth and password-auth templates in /etc/authselect/custom/<profile>/ :

password requisite pam_pwquality.so

Then apply the configuration:

# authselect apply-changes

If the system is not yet managed by authselect, or authselect check reports the configuration is not valid, first establish or restore the profile as described in the section overview.

Note: pam_pwquality is a base-profile module - there is no with-pwquality feature to enable (unlike with-faillock and with-pwhistory ).

Impact:

pam_pwquality enforces password-complexity requirements when users set or change passwords. Overly strict complexity settings can frustrate users, increase help-desk password-reset volume, and encourage insecure workarounds, so complexity thresholds should be balanced against usability.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-6b., 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: f3a68187eac30eaf787a476fc7b2fd2edbda4345dff80fa240abdbf555eb37b5