UCF STIG Viewer Logo

The system must require passwords contain a minimum of 15 characters.


Overview

Finding ID Version Rule ID IA Controls Severity
V-11947 GEN000580 SV-63903r3_rule Medium
Description
The use of longer passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques by increasing the password search space.
STIG Date
Oracle Linux 5 Security Technical Implementation Guide 2020-02-25

Details

Check Text ( C-52427r3_chk )
Check the system password length setting.

Procedure:
Check the password minlen option
# grep pam_cracklib.so /etc/pam.d/system-auth

Confirm the minlen option is set to at least 15 as in the example below:

password required pam_cracklib.so minlen=15

There may be other options on the line. If no such line is found, or the minlen is less than 15 this is a finding.

# grep PASS_MIN_LEN /etc/login.defs

Confirm the PASS_MIN_LEN option is set to at least 15 as in the example below:

PASS_MIN_LEN 15

If this line does not exist, or is less than 15, this is a finding.
Fix Text (F-54479r3_fix)
Edit "/etc/pam.d/system-auth" to include the line:

password required pam_cracklib.so minlen=15

prior to the "password include system-auth-ac" line.

Edit /etc/login.defs to include the line:

PASS_MIN_LEN 15