Detections
Analytics
GEN000790 - The system must prevent the use of dictionary words for passwords.
Information
An easily guessable password provides an open door to any external or internal malicious intruder. Many computer compromises occur as the result of account name and password guessing. This is generally done by someone with an automated script using repeated logon attempts until the correct account and password pair is guessed. Utilities, such as cracklib, can be used to validate that passwords are not dictionary words and meet other criteria during password changes.Solution
Install the default dictionary of words from the 'bos.data' fileset with smitty or installp.# smitty installp
#installp bos.data
Customize or modify the dictionary in /usr/share/dict/words as necessary.
#vi /usr/share/dict/words
Add a dictionary list to /etc/security/user file with the chsec command.
#chsec -f /etc/security/user -s default -a dictionlist=/usr/share/dict/words
See Also
http://iasecontent.disa.mil/stigs/zip/U_STIG_Library_2015_07.zip
Item Details
Audit Name: DISA AIX 5.3 STIG v1r2
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1), CAT|II, CCI|CCI-000189, Rule-ID|SV-38678r1_rule, STIG-ID|GEN000790, Vuln-ID|V-22307
Plugin: Unix
Control ID: ea745d6f3a96098d63774a6313b9ec39e5755c3603411c38fa20f62742b94006