Detections
Analytics

5.3.3.2.6 Ensure password dictionary check is enabled

Information

The pwquality dictcheck option sets whether to check for the words from the cracklib dictionary.

Passwords based on dictionary words are among the first candidates attempted by password-cracking tools. Checking a new password against the cracklib dictionary and rejecting dictionary-based passwords defeats dictionary attacks and reduces the likelihood of a password being successfully guessed.

Solution

Edit any file ending in .conf in the /etc/security/pwquality.conf.d/ directory and/or the file /etc/security/pwquality.conf and comment out or remove any instance of dictcheck = 0 :

Example:

# sed -ri 's/^\s*dictcheck\s*=/# &/' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf

Run the following script to remove setting dictcheck on the pam_pwquality.so module in the PAM files:

#!/usr/bin/env bash

{
 for l_pam_file in system-auth password-auth; do
 l_authselect_file="/etc/authselect/$(head -1 /etc/authselect/authselect.conf | grep 'custom/')/$l_pam_file"
 sed -ri 's/(^\s*password\s+(requisite|required|sufficient)\s+pam_pwquality\.so.*)(\s+dictcheck\s*=\s*\S+)(.*$)/\1\4/' "$l_authselect_file"
 done
 authselect apply-changes
}

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 71b571a9afcf3415cbdd23ea5a3128dc4da9bec6e4c7a65951bf7a8979681355