Detections
Analytics

5.3.3.2.3 Ensure password complexity is configured

Information

Password complexity can be set through:

 - minclass - The minimum number of classes of characters required in a new password. (digits, uppercase, lowercase, others). e.g. minclass = 4 requires digits, uppercase, lower case, and special characters.
 - dcredit - The maximum credit for having digits in the new password. If less than 0 it is the minimum number of digits in the new password. e.g. dcredit = -1 requires at least one digit
 - ucredit - The maximum credit for having uppercase characters in the new password. If less than 0 it is the minimum number of uppercase characters in the new password. e.g. ucredit = -1 requires at least one uppercase character
 - ocredit - The maximum credit for having other characters in the new password. If less than 0 it is the minimum number of other characters in the new password. e.g. ocredit = -1 requires at least one special character
 - lcredit - The maximum credit for having lowercase characters in the new password. If less than 0 it is the minimum number of lowercase characters in the new password. e.g. lcredit = -1 requires at least one lowercase character

Strong passwords protect systems from being hacked through brute force methods.

Solution

Create or modify a file ending inconf in the /etc/security/pwquality.conf.d/ directory or the file /etc/security/pwquality.conf and add or modify the following line to set:

 - minclass = 4

--AND/OR--

 - dcredit = -_N_
 - ucredit = -_N_
 - ocredit = -_N_
 - lcredit = -_N_

Example:

# sed -ri 's/^s*minclasss*=/# &/' /etc/security/pwquality.conf
# printf '
%s' "minclass = 4" >> /etc/security/pwquality.conf.d/50-pwcomplexity.conf

--AND/OR--

# sed -ri 's/^s*[dulo]credits*=/# &/' /etc/security/pwquality.conf
# printf '%s
' "dcredit = -1" "ucredit = -1" "ocredit = -1" "lcredit = -1" > /etc/security/pwquality.conf.d/50-pwcomplexity.conf

Run the following script to remove setting minclass dcredit ucredit lcredit and ocredit on the pam_pwquality.so module in the PAM files

#!/usr/bin/env bash

{
 for l_pam_file in system-auth password-auth; do
 l_authselect_file="/etc/authselect/$(head -1 /etc/authselect/authselect.conf | grep 'custom/')/$l_pam_file"
 sed -ri 's/(^s*passwords+(requisite|required|sufficient)s+pam_pwquality.so.*)(s+minclasss*=s*S+)(.*$)/14/' "$l_authselect_file"
 sed -ri 's/(^s*passwords+(requisite|required|sufficient)s+pam_pwquality.so.*)(s+dcredits*=s*S+)(.*$)/14/' "$l_authselect_file"
 sed -ri 's/(^s*passwords+(requisite|required|sufficient)s+pam_pwquality.so.*)(s+ucredits*=s*S+)(.*$)/14/' "$l_authselect_file"
 sed -ri 's/(^s*passwords+(requisite|required|sufficient)s+pam_pwquality.so.*)(s+lcredits*=s*S+)(.*$)/14/' "$l_authselect_file"
 sed -ri 's/(^s*passwords+(requisite|required|sufficient)s+pam_pwquality.so.*)(s+ocredits*=s*S+)(.*$)/14/' "$l_authselect_file"
 done
 authselect apply-changes
}

See Also

https://workbench.cisecurity.org/benchmarks/18211

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 01a0711b9fd19de71b865071ed966da0523895741ac3be206955cba4e1a0a288