The system must prevent the use of dictionary words for passwords.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22307	GEN000790	SV-38278r1_rule	IAIA-1 IAIA-2	Medium

Description
An easily guessable password provides an open door to any external or internal malicious intruder. Many computer compromises occur as the result of account name and password guessing. This is generally done by someone with an automated script using repeated logon attempts until the correct account and password pair is guessed. Utilities, such as cracklib, can be used to validate that passwords are not dictionary words and meet other criteria during password changes.

Description

An easily guessable password provides an open door to any external or internal malicious intruder. Many computer compromises occur as the result of account name and password guessing. This is generally done by someone with an automated script using repeated logon attempts until the correct account and password pair is guessed. Utilities, such as cracklib, can be used to validate that passwords are not dictionary words and meet other criteria during password changes.

STIG	Date
HP-UX 11.23 Security Technical Implementation Guide	2015-04-03

Details

Check Text ( C-36294r1_chk )
HP-UX by default does not currently support enforcement of barring the use of dictionary words in passwords. This is a finding.

Fix Text (F-31551r1_fix)
Consult site documentation for the required policy specifying non-use of dictionary words in passwords during a password change. Change the policy statement/setting to disallow the use of dictionary words in passwords.