UCF STIG Viewer Logo

The macOS system must enforce password complexity by requiring that at least one numeric character be used.


Overview

Finding ID Version Rule ID IA Controls Severity
V-209616 AOSX-14-003007 SV-209616r610285_rule Medium
Description
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.
STIG Date
Apple OS X 10.14 (Mojave) Security Technical Implementation Guide 2021-11-19

Details

Check Text ( C-9867r282330_chk )
To check the currently applied policies for passwords and accounts, use the following command:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep requireAlphanumeric

If the return is not “requireAlphanumeric = 1”, this is a finding.
Fix Text (F-9867r282331_fix)
This setting is enforced using the "Passcode Policy" configuration profile.