Detections
Analytics

4.4.1.1.1 Ensure password length is configured

Information

minlen - Minimum acceptable size for the new password.

Below are the minimum allowed password lengths for different kinds of passwords/passphrases. The keyword disabled can be used to disallow passwords of a given kind regardless of length. Each subsequent number must be no larger than the preceding one.

N0 is used for passwords consisting of characters from one character class only. The character classes are digits, lower-case, upper-case, and other characters. There is also a special class for non-ASCII characters that cannot be classified but are assumed to be non-digits.

N1 is used for passwords consisting of characters from two character classes that do not meet the requirements for a passphrase.

N2 is used for passphrases. A passphrase must consist of sufficient words.

N3 and N4 are used for passwords of characters from three and four-character classes, respectively.

In addition to being sufficiently long, passwords must contain enough different characters for the character classes and the minimum length they have been checked against.

Strong passwords protect systems from being hacked through brute-force methods.

Solution

Create or modify the file /etc/pam.d/passwd and add or modify the following line to set the password length of 14 or more characters. Ensure that password length conforms to local site policy:

Example:

password requisite pam_passwdqc.so enforce=everyone minlen=disabled,14,12,8,6

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 7f8ff3f7e3bf524caf32bf8acb117a816c907681f6bc9fcaba4761367f27449f