Detections
Analytics

5.3.2.2.3 Ensure password length is configured

Information

minlen - Minimum acceptable size for the new password (plus one if credits are not disabled which is the default). Cannot be set to lower value than 6.

More information about the pam_pwquality.so module configuration files, their location, and load preference is available in the section overview.

Strong passwords protect systems from being hacked through brute force methods.

Solution

Create or modify a file ending in .conf in the /etc/security/pwquality.conf.d/ directory and add or modify the following line to set password length of 14 or more characters. Ensure that password length conforms to local site policy:

minlen=14

Example:

#!/usr/bin/env bash

{
 sed -ri 's/^\s*minlen\s*=/# &/' /etc/security/pwquality.conf 2>/dev/null
 [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/
 printf '\n%s' "minlen = 14" > /etc/security/pwquality.conf.d/50-pwlength.conf
}

See Also

https://workbench.cisecurity.org/benchmarks/26236

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: fca4ea414de6dc5fedc1a22ca3eaa601ec426fae4cb931a6f6841c0427c65d2a