Detections
Analytics
5.3.3.2.2 Ensure password length is configured
Information
The minlen option sets the minimum acceptable length for a new password. When character-class credits are enabled (the default), each credited class can count as one additional character toward satisfying this minimum. The value cannot be set lower than 6.The effort required to guess or crack a password, particularly through offline brute-force attacks, grows rapidly as the password lengthens. Enforcing a minimum password length raises the work factor an attacker must expend and reduces the effectiveness of exhaustive guessing.
Solution
Create or modify a file ending in .conf in the /etc/security/pwquality.conf.d/ directory or the file /etc/security/pwquality.conf and add or modify the following line to set password length of 14 or more characters. Ensure that password length conforms to local site policy:Example:
# sed -ri 's/^\s*minlen\s*=/# &/' /etc/security/pwquality.conf
# printf '%s\n' "" "minlen = 14" >> /etc/security/pwquality.conf.d/50-pwlength.conf
Run the following script to remove setting minlen on the pam_pwquality.so module in the PAM files:
#!/usr/bin/env bash
{
for l_pam_file in system-auth password-auth; do
l_authselect_file="/etc/authselect/$(head -1 /etc/authselect/authselect.conf | grep 'custom/')/$l_pam_file"
sed -ri 's/(^\s*password\s+(requisite|required|sufficient)\s+pam_pwquality\.so.*)(\s+minlen\s*=\s*[0-9]+)(.*$)/\1\4/' "$l_authselect_file"
done
authselect apply-changes
}
See Also
Item Details
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4
Plugin: Unix
Control ID: c4697698d86c3d74dd7adec5f9ef585b1c091f0a1f32f215f2a07d4c18203b82