6.3.1 Set Password Creation Requirement Parameters Using pam_cracklib - password required

Information

The pam_cracklib module checks the strength of passwords. It performs checks such as making sure a password is not a dictionary word, it is a certain length, contains a mix of characters (e.g. alphabet, numeric, other) and more. The following are definitions of the pam_cracklib.so options.

try_first_pass - retrieve the password from a previous stacked PAM module. If not available, then prompt the user for a password.

retry=3 - allow three tries before sending back a failure.

minlen=14 - password must be 14 characters or more

dcredit=-1 - provide at least one digit

ucredit=-1 - provide at least one uppercase character

ocredit=-1 - provide at least one special character

lcredit=-1 - provide at least one lowercase character

The setting shown above is one possible policy. Alter these values to conform to your own organization's password policies.

Rationale:

Strong passwords protect systems from being hacked through brute force methods.

Solution

Set the pam_cracklib.so parameters as follows in /etc/pam.d/system-auth:

password required pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1

Default Value:

OS Default: N/A

See Also

https://workbench.cisecurity.org/files/3096

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CSCv6|16.7, CSCv7|4.4

Plugin: Unix

Control ID: 31979649d8b0bb59ccb1cc03ccbc09dc8b629fabfe8b720ba3825c23eaea6dda