UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The system must require passwords contain a minimum of 14 characters.


Overview

Finding ID Version Rule ID IA Controls Severity
V-11947 GEN000580 SV-46194r1_rule IAIA-1 IAIA-2 Medium
Description
The use of longer passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques by increasing the password search space.
STIG Date
SUSE Linux Enterprise Server v11 for System z 2012-12-13

Details

Check Text ( C-43423r1_chk )
Check the system password length setting.

Procedure:
Check the password minlen option
# grep pam_cracklib.so /etc/pam.d/ common-{auth,account,password,session}

Confirm the minlen option is set to at least 14 as in the example below:

password required pam_cracklib.so minlen=14

There may be other options on the line. If no such line is found, or the minlen is less than 14 this is a finding.
Fix Text (F-39526r1_fix)
Edit /etc/pam.d/common-password-pc and set the minlen setting to 14 or more on the pam_cracklib line.