AIX must prevent the use of dictionary words for passwords.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-91567	AIX7-00-001132	SV-101665r1_rule		Medium

Description
If the operating system allows the user to select passwords based on dictionary words, then this increases the chances of password compromise by increasing the opportunity for successful guesses and brute-force attacks.

STIG	Date
IBM AIX 7.x Security Technical Implementation Guide	2020-02-24

Details

Check Text ( C-90721r1_chk )
From the command prompt, run the following command to check if the default "dictionlist" attribute is set: # lssec -f /etc/security/user -s default -a dictionlist The above command should yield the following output: dictionlist="/etc/security/ice/dictionary/English" If the above command shows an empty string for default "dictionlist" attribute, this is a finding. From the command prompt, run the following command to check if "dictionlist" attribute is set for all users: # lsuser -a dictionlist ALL The above command should yield the following output: root dictionlist=/etc/security/ice/dictionary/English daemon dictionlist=/etc/security/ice/dictionary/English bin dictionlist=/etc/security/ice/dictionary/English sys dictionlist=/etc/security/ice/dictionary/English If any user's "dictionlist" attribute is empty, this is a finding.

Check Text ( C-90721r1_chk )

From the command prompt, run the following command to check if the default "dictionlist" attribute is set:
# lssec -f /etc/security/user -s default -a dictionlist

The above command should yield the following output:
dictionlist="/etc/security/ice/dictionary/English"

If the above command shows an empty string for default "dictionlist" attribute, this is a finding.

From the command prompt, run the following command to check if "dictionlist" attribute is set for all users:
# lsuser -a dictionlist ALL

The above command should yield the following output:
root dictionlist=/etc/security/ice/dictionary/English
daemon dictionlist=/etc/security/ice/dictionary/English
bin dictionlist=/etc/security/ice/dictionary/English
sys dictionlist=/etc/security/ice/dictionary/English

If any user's "dictionlist" attribute is empty, this is a finding.

Fix Text (F-97765r1_fix)
From the command prompt, run the following command to set "dictionlist" attribute for the default stanza in "/etc/security/user": # chsec -f /etc/security/user -s default -a dictionlist="/etc/security/ice/dictionary/English" From the command prompt, run the following command to set "dictionlist" attribute for users who have an empty "dictionlist" attribute: # chsec -f /etc/security/user -s [user_name] -a dictionlist="/etc/security/ice/dictionary/English"

Fix Text (F-97765r1_fix)

From the command prompt, run the following command to set "dictionlist" attribute for the default stanza in "/etc/security/user":
# chsec -f /etc/security/user -s default -a dictionlist="/etc/security/ice/dictionary/English"

From the command prompt, run the following command to set "dictionlist" attribute for users who have an empty "dictionlist" attribute:
# chsec -f /etc/security/user -s [user_name] -a dictionlist="/etc/security/ice/dictionary/English"