Detections
Analytics

5.3.3.2.6 Ensure password dictionary check is enabled

Information

The pwquality dictcheck option sets whether to check for the words from the cracklib dictionary.

If the operating system allows the user to select passwords based on dictionary words, this increases the chances of password compromise by increasing the opportunity for successful guesses, and brute-force attacks.

Solution

Edit any file ending in .conf in the /etc/security/pwquality.conf.d/ directory and/or the file /etc/security/pwquality.conf and comment out or remove any instance of dictcheck = 0 :

Example:

# sed -ri 's/^\s*dictcheck\s*=/# &/' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf 2>/dev/null

Run the following command:

# grep -Pl -- '\bpam_pwquality\.so\h+([^#\n\r]+\h+)?dictcheck\b' /usr/share/pam-configs/*

Edit any returned files and remove the dictcheck argument from the pam_pwquality.so line(s)

Impact:

Without dictionary checking, users can set passwords that are common words or simple modifications of words, which are trivially crackable via dictionary attacks even when they meet length and complexity requirements.

See Also

https://workbench.cisecurity.org/benchmarks/27797

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: de3fe65f3ff5d968e5112d7516340efce65ccff2d42055ed64538c30be7ee2a9