UCF STIG Viewer Logo

The Photon operating system must use the pam_cracklib module.


Overview

Finding ID Version Rule ID IA Controls Severity
V-239146 PHTN-67-000075 SV-239146r816654_rule Medium
Description
If the operating system allows the user to select passwords based on dictionary words, this increases the chances of password compromise by increasing the opportunity for successful guesses and brute-force attacks.
STIG Date
VMware vSphere 6.7 Photon OS Security Technical Implementation Guide 2022-06-17

Details

Check Text ( C-42357r675244_chk )
At the command line, execute the following command:

# grep pam_cracklib /etc/pam.d/system-password

If the output does not return at least "password requisite pam_cracklib.so", this is a finding.
Fix Text (F-42316r816653_fix)
Open /etc/applmgmt/appliance/system-password with a text editor.

Comment out any existing "pam_cracklib.so" line and add the following:

password requisite pam_cracklib.so dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 minlen=8 minclass=4 difok=4 retry=3 maxsequence=0 enforce_for_root

Save and close.