The system must require passwords contain a minimum of 15 characters.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-11947	GEN000580	SV-46194r2_rule		Medium

Description
The use of longer passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques by increasing the password search space.

STIG	Date
SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide	2018-09-19

Details

Check Text ( C-43423r7_chk )
Check the system password length setting. Procedure: Check the password minlen option # grep pam_cracklib.so /etc/pam.d/ common-{auth,account,password,session} Confirm the minlen option is set to at least 15 as in the example below: password required pam_cracklib.so minlen=15 There may be other options on the line. If no such line is found, or the minlen is less than 15 this is a finding.

Fix Text (F-39526r6_fix)
Edit /etc/pam.d/common-password and add or edit a pam_cracklib.so entry with a minlen parameter set equal to or greater than 15. NOTE: /etc/pam.d/common-password is normally a symbolic link that points to common-password-pc or common-password-local, a file to be ‘included’ by other pam configuration files.