CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 4.4.1
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Description
The pam_pwquality.so module checks the strength of passwords. It performs checks such as making sure a password is not a dictionary word, it is a certain length, contains a mix of characters (e.g. alphabet, numeric, other) and more. The following are definitions of the pam_pwquality.so options:
minlen = 14 - password must be 14 characters or moreminclass = 4 - The minimum number of required classes of characters for the new password (digits, uppercase, lowercase, others)
Rationale
Strong passwords protect systems from being hacked through brute force methods.
Audit Procedure
Command Line
Run the following command to verify password creation requirements:
grep -Pi '^\h*minlen\h*=\h*(1[4-9]|[2-9][0-9]|[1-9][0-9]{2,})\b' /etc/security/pwquality.conf
grep -Pi '^\h*minclass\h*=\h*4\b' /etc/security/pwquality.conf
Expected Result
minlen = 14
minclass = 4
Or higher values.
Remediation
Command Line
Edit or add the following lines in /etc/security/pwquality.conf:
minlen = 14
minclass = 4
Run the following command to verify that the pam_pwquality module is enabled:
grep -P '^\h*password\h+(requisite|required)\h+pam_pwquality\.so' /etc/pam.d/common-password
If the module is not enabled, add or edit the following line in /etc/pam.d/common-password:
password requisite pam_pwquality.so retry=3
Default Value
minlen = 8
minclass = 0
References
- NIST SP 800-53 Rev. 5: IA-5(1)
CIS Controls
v8 - 5.2 Use Unique Passwords - Use unique passwords for all enterprise assets.
v7 - 4.4 Use Unique Passwords - Where multi-factor authentication is not supported, accounts will use passwords that are unique to that system.
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Assessment Status
Automated
