Detections
Analytics

3.11 (L1) Host must enforce password complexity

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The enforcement of password complexity is managed through the Security.PasswordQualityControl parameter, allowing configuration of password length, character set requirements, and failed logon attempt restrictions. The recommended setting is "retry=3 min=disabled,15,15,15,15 max=64 similar=deny passphrase=3".

Abiding by NIST 800-63B Section 5.1.1.2 guidelines, not enforcing traditional composition rules facilitates the adoption of longer, more secure passphrases, enhancing overall security.

Solution

To set the password complexity requirements, perform the following PowerCLI command:

Get-VMHOST | Get-AdvancedSetting -Name "Security.PasswordQualityControl" | Set-AdvancedSetting -Value "retry=3 min=disabled,disabled,disabled,disabled,15"

The above requires all passwords to be 15 or more characters long and comprised of at least one character from four distinct character sets.

Impact:

Altering password complexity via Security.PasswordQualityControl may cause installation issues with other products and services within the VMware ecosystem not expecting such changes.

See Also

https://workbench.cisecurity.org/benchmarks/21888

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CSCv7|4.4

Plugin: VMware

Control ID: d764f3d0f88f5a1cb0ba1e1ebe172f6c3382e3904ce9ee5d4921419fafc2ae40