A minimum password length must be set.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-25230	OSX00030 M6	SV-37172r1_rule	IAIA-1 IAIA-2	Medium

Description
Information systems not protected with strong password schemes including passwords of minimum length provide the opportunity for anyone to crack the password and gain access to the system, and cause the device, information, or the local network to be compromised or a Denial of Service.

STIG	Date
MAC OSX 10.6 Workstation Security Technical Implementation Guide	2012-01-30

Details

Check Text ( C-35877r1_chk )
Open a terminal session and enter the following command to view the setting for minimum password length. sudo pwpolicy -n -getglobalpolicy \| tr " " "\n" \| grep minChars If the value of minChars is less than 15, this is a finding. NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems. pwpolicy -n /Local/Default -getglobalpolicy \| tr " " "\n" \| grep minChars If the value of minChars is less than 15, this is a finding.

Check Text ( C-35877r1_chk )

Open a terminal session and enter the following command to view the setting for minimum password length.
sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep minChars
If the value of minChars is less than 15, this is a finding.

NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems.
pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep minChars
If the value of minChars is less than 15, this is a finding.

Fix Text (F-31132r1_fix)
Open a terminal session and use the following command to set the value for minimum password length. sudo pwpolicy -n -setglobalpolicy "minChars=15" NOTE: For non-managed system, use the following command. pwpolicy -n /Local/Default -setglobalpolicy "minChars=15"