UBTU-20-010057 - The Ubuntu operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. 'pwquality' enforces complex password construction configuration and has the ability to limit brute-force attacks on the system.

Solution

Configure the operating system to use 'pwquality' to enforce password complexity rules.

Install the 'pam_pwquality' package by using the following command:

$ sudo apt-get install libpam-pwquality -y

Add the following line to '/etc/security/pwquality.conf' (or modify the line to have the required value):

enforcing = 1

Add the following line to '/etc/pam.d/common-password' (or modify the line to have the required value):

password requisite pam_pwquality.so retry=3

Note: The value of 'retry' should be between '1' and '3'.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CAN_Ubuntu_20-04_LTS_V1R10_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000366, Rule-ID|SV-238228r653859_rule, STIG-ID|UBTU-20-010057, Vuln-ID|V-238228

Plugin: Unix

Control ID: a76c981ecaca2bcf9bd648b07c875790822955f867cbf765e6a5711cf4b37a73