UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The system must prevent the use of dictionary words for passwords.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22307 GEN000790 SV-26345r1_rule IAIA-1 IAIA-2 Medium
Description
An easily guessable password provides an open door to any external or internal malicious intruder. Many computer compromises occur as the result of account name and password guessing. This is generally done by someone with an automated script using repeated logon attempts until the correct account and password pair is guessed. Utilities, such as cracklib, can be used to validate passwords are not dictionary words and meet other criteria during password changes.
STIG Date
SOLARIS 10 SPARC SECURITY TECHNICAL IMPLEMENTATION GUIDE 2016-06-22

Details

Check Text ( C-27451r2_chk )
Check /etc/default/passwd for dictionary check configuration.

# grep DICTION /etc/default/passwd

If the DICTIONLIST or DICTIONDBDIR settings are not present, or are set to non-existent files or directories, this is a finding.
Fix Text (F-23521r1_fix)
Edit /etc/default/passwd; add or set DICTIONLIST to the dictionary file and DICTIONDBDIR to a database directory such as /var/passwd. Generate the password dictionary by running the mkpwdict command.