Detections
Analytics

5.3.2.2.1 Ensure password dictionary check is enabled

Information

dictcheck : If nonzero, check whether the password (with possible modifications) matches a word in a dictionary. Currently the dictionary check is performed using the cracklib library. (default 1)

More information about the pam_pwquality.so module configuration files, their location, and load preference is available in the section overview.

If the operating system allows the user to select passwords based on dictionary words, this increases the chances of password compromise by increasing the opportunity for successful guesses, and brute-force attacks.

Solution

Edit any file ending in .conf in the /etc/security/pwquality.conf.d/ directory and/or the file /etc/security/pwquality.conf and comment out or remove any instance of dictcheck = 0 :

Example:

# sed -ri 's/^\s*dictcheck\s*=/# &/' /usr/lib/security/pwquality.conf /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf

See Also

https://workbench.cisecurity.org/benchmarks/26236

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 28027ceca73e3e80992c3f62498b5fb25280c8b84be3b292271cba67971e852d