5.2.5 Ensure Complex Password Must Contain Special Character Is Configured

Information

Complex passwords contain one character from each of the following classes: English uppercase letters, English lowercase letters, Westernized Arabic numerals, and non-alphanumeric characters. Ensure that a special character is part of the password policy on the computer.

The more complex a password, the more resistant it will be against persons seeking unauthorized access to a system.

Solution

Terminal Method:

Run the following command to set passwords to require at least one special character:

$ /usr/bin/sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy -setaccountpolicies "requiresSymbol=<value>=1>"

example

:

$ /usr/bin/sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "requiresSymbol=1"

Profile Method:

Create or edit a configuration profile with the following information:

- The PayloadType string is com.apple.mobiledevice.passwordpolicy
- The key to include is minComplexChars
- The key must be set to <integer><value>=1></integer>

Note: The profile method is the preferred method for setting password policy since -setglobalpolicy in pwpolicy is deprecated and will likely be removed in a future macOS release.

Impact:

Password policy should be in effect to reduce the risk of exposed services being compromised easily through dictionary attacks or other social engineering attempts.

See Also

https://workbench.cisecurity.org/benchmarks/15551

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 4ccf5c5ddc939ccc74a74555e8d4d6a5b9d9ec912bf6eb2d5f8d7633a39b0b66