Detections
Analytics

1.97 UBTU-22-611045

Information

The operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.

GROUP ID: V-260567
RULE ID: SV-260567r991587

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. "pwquality" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system.

Solution

Configure the operating system to enforce password complexity rules.

Add or modify the following line in the "/etc/security/pwquality.conf" file:

enforcing = 1

Add or modify the following line in the "/etc/pam.d/common-password" file:

password requisite pam_pwquality.so retry=3

Note: The value of "retry" should be between "1" and "3".

See Also

https://workbench.cisecurity.org/benchmarks/22168

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, CSCv7|4.4, Rule-ID|SV-260567r991587_rule, STIG-ID|UBTU-22-611045, Vuln-ID|V-260567

Plugin: Unix

Control ID: 3790189486136b65c816d0cd61922a6d8041b2bb5581f06165c3fc2336c353c7