Detections
Analytics

7.5 Ensure Password Complexity Policies are in Place

Information

Password complexity includes password characteristics such as length, case, numeric, and character sets. For MySQL 9.x, use the component_validate_password implementation rather than relying on the deprecated plugin path, and combine complexity settings with dictionary checks and approved password policy values.

Complex passwords help mitigate dictionary, brute force, and other password attacks. This recommendation prevents users from choosing weak passwords that can easily be guessed.

Solution

Install the password validation component if not already present:

INSTALL COMPONENT 'file://component_validate_password';

Persist the following configuration:

SET PERSIST validate_password.length=14;
SET PERSIST validate_password.check_user_name=ON;
SET PERSIST validate_password.dictionary_file=<path to dictionary file>;
SET PERSIST validate_password.policy=STRONG;

Optionally set one or more of these if required by policy:

SET PERSIST validate_password.mixed_case_count=1;
SET PERSIST validate_password.number_count=1;
SET PERSIST validate_password.special_char_count=1;

Migrate from the deprecated validate password plugin to the component if legacy deployments remain.

Impact:

The deprecated validate password plugin can still appear in older environments, but the component-based implementation is preferred for MySQL 9.x.

See Also

https://workbench.cisecurity.org/benchmarks/22687

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CSCv7|4.4

Plugin: MySQLDB

Control ID: 35977db33a64586fb7dca2059a5714198711d64ae84b005a1c7297e5d2ef81d6