Detections
Analytics

UBTU-20-010057 - The Ubuntu operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.

Information

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. "pwquality" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system.

Solution

Configure the operating system to use "pwquality" to enforce password complexity rules.

Install the "pam_pwquality" package by using the following command:

$ sudo apt-get install libpam-pwquality -y

Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value):

enforcing = 1

Add the following line to "/etc/pam.d/common-password" (or modify the line to have the required value):

password requisite pam_pwquality.so retry=3

Note: The value of "retry" should be between "1" and "3".

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CAN_Ubuntu_20-04_LTS_V2R4_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-238228r991587_rule, STIG-ID|UBTU-20-010057, Vuln-ID|V-238228

Plugin: Unix

Control ID: 50b3c72d9d04a177122b9cc10ae59e4efbf33411eb6e9c8bccb2c8cf8d139b7c