The system must prevent the use of dictionary words for passwords.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22307	GEN000790	SV-44883r1_rule	IAIA-1 IAIA-2	Medium

Description
An easily guessable password provides an open door to any external or internal malicious intruder. Many computer compromises occur as the result of account name and password guessing. This is generally done by someone with an automated script that uses repeated logon attempts until the correct account and password pair is guessed. Utilities, such as cracklib, can be used to validate passwords are not dictionary words and meet other criteria during password changes.

Description

An easily guessable password provides an open door to any external or internal malicious intruder. Many computer compromises occur as the result of account name and password guessing. This is generally done by someone with an automated script that uses repeated logon attempts until the correct account and password pair is guessed. Utilities, such as cracklib, can be used to validate passwords are not dictionary words and meet other criteria during password changes.

STIG	Date
SUSE Linux Enterprise Server v11 for System z	2012-12-13

Details

Check Text ( C-42337r1_chk )
Check /etc/pam.d/common-password for pam_cracklib configuration. # grep pam_cracklib /etc/pam.d/common-password* If pam_cracklib is not present, this is a finding. Ensure the passwd command uses the common-password settings. # grep common-password /etc/pam.d/passwd If a line "password include common-password" is not found then the password checks in common-password will not be applied to new passwords, this is a finding.

Check Text ( C-42337r1_chk )

Check /etc/pam.d/common-password for pam_cracklib configuration.
# grep pam_cracklib /etc/pam.d/common-password*
If pam_cracklib is not present, this is a finding.

Ensure the passwd command uses the common-password settings.
# grep common-password /etc/pam.d/passwd

If a line "password include common-password" is not found then the password checks in common-password will not be applied to new passwords, this is a finding.

Fix Text (F-38315r1_fix)
Edit /etc/pam.d/common-password and configure pam_cracklib by adding a line such as "password required pam_cracklib.so"