5.2.4 Complex passwords must contain a Numeric Character

Information

Complex passwords contain one character from each of the following classes: English uppercase letters, English lowercase letters, Westernized Arabic numerals, and non-alphanumeric characters.

Ensure that a number or numeric value is part of the password policy on the computer.

Rationale:

The more complex a password the more resistant it will be against persons seeking unauthorized access to a system.

Impact:

Password policy should be in effect to reduce the risk of exposed services being compromised easily through dictionary attacks or other social engineering attempts.

Solution

Run the following command to set passwords to require at least one number:

$ sudo pwpolicy -a <administratoraccount> -setaccountpolicies 'requiresNumeric=<value>=1>'

example:

$ sudo pwpolicy -a test -setglobalpolicy 'requiresNumeric=2'

See Also

https://workbench.cisecurity.org/files/3013

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1)(a)

Plugin: Unix

Control ID: cad470d8583cddc9f2120f4f83776421745857954d0af81594c8f7fbafe9b5de