Detections
Analytics

AOSX-13-000585 - The macOS system must enforce password complexity by requiring that at least one numeric character be used.

Information

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Solution

This setting may be enforced using the 'Passcode Policy' configuration profile or by a directory service.

To set the password policy without a configuration profile, run the following command to save a copy of the current 'pwpolicy' account policy file:

/usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies | tail -n +2 > pwpolicy.plist

Open the generated file in a text editor.

If the file does not yet contain any policy settings, replace <dict/> with <dict></dict>; then insert the following text after the opening <dict> tag and before the closing </dict> tag.

The same text can also be used if the line '<key>policyCategoryPasswordContent</key>' is not present.

<key>policyCategoryPasswordContent</key>
<array>
<dict>
<key>policyContent</key>
<string>policyAttributePassword matches '(.*[0-9].*){1,}+'</string>
<key>policyIdentifier</key>
<string>com.apple.policy.legacy.requiresNumeric</string>
<key>policyParameters</key>
<dict>
<key>minimumNumericCharacters</key>
<integer>1</integer>
</dict>
</dict>
</array>

If the file does contain policy settings, and the line '<key>policyCategoryPasswordContent</key>' does exist, insert the following text after the opening <array> tag that comes right after it:

<dict>
<key>policyContent</key>
<string>policyAttributePassword matches '(.*[0-9].*){1,}+'</string>
<key>policyIdentifier</key>
<string>com.apple.policy.legacy.requiresNumeric</string>
<key>policyParameters</key>
<dict>
<key>minimumNumericCharacters</key>
<integer>1</integer>
</dict>
</dict>

After saving the file and exiting to the command prompt, run the following command to load the new policy file:

/usr/bin/sudo /usr/bin/pwpolicy setaccountpolicies pwpolicy.plist

Note: Updates to password restrictions must be thoroughly evaluated in a test environment. Mistakes in configuration may block password change and local user creation operations, as well as lock out all local users, including administrators.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_OS_X_10-13_V2R5_STIG.zip

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1)(a), CAT|II, CCI|CCI-000194, Rule-ID|SV-214879r609363_rule, STIG-ID|AOSX-13-000585, STIG-Legacy|SV-96351, STIG-Legacy|V-81637, Vuln-ID|V-214879

Plugin: Unix

Control ID: 35868e496b449383b3b5ad441686ba4e0b50041d40f6885763ba9907074c0f20