The system must require passwords to contain a minimum of 14 characters.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-11947	GEN000580	SV-38936r1_rule	IAIA-1 IAIA-2	Medium

Description
The use of longer passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques by increasing the password search space.

STIG	Date
Draft AIX Security Technical Implementation Guide	2011-08-17

Details

Check Text ( C-28028r1_chk )
Check the system password length setting. # /usr/sbin/lsuser -a minlen ALL If minlen is not set to 14 or more, this is a finding.

Fix Text (F-31635r1_fix)
Change the minimum password length to 14 or more. #chsec –f /etc/security/user –s default –a minlen=14 #chuser minlen=14