GEN000790 - The system must prevent the use of dictionary words for passwords.

Information

An easily guessable password provides an open door to any external or internal malicious intruder. Many computer compromises occur as the result of account name and password guessing. This is generally done by someone with an automated script using repeated logon attempts until the correct account and password pair is guessed. Utilities, such as cracklib, can be used to validate that passwords are not dictionary words and meet other criteria during password changes.

Solution

Install the default dictionary of words from the 'bos.data' fileset with smitty or installp.
# smitty installp
#installp bos.data
Customize or modify the dictionary in /usr/share/dict/words as necessary.
#vi /usr/share/dict/words
Add a dictionary list to /etc/security/user file with the chsec command.
#chsec -f /etc/security/user -s default -a dictionlist=/usr/share/dict/words

See Also

http://iasecontent.disa.mil/stigs/zip/U_STIG_Library_2015_07.zip

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(4), CAT|II, CCI|CCI-000189, Rule-ID|SV-38678r1_rule, STIG-ID|GEN000790, Vuln-ID|V-22307

Plugin: Unix

Control ID: ea745d6f3a96098d63774a6313b9ec39e5755c3603411c38fa20f62742b94006