The Ubuntu operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.

An XCCDF Rule

Description

<VulnDiscussion>Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. "pwquality" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-238228r991587_rule
Severity: Medium
References: CCI-000366
Updated: 17 days ago

Configure the operating system to use "pwquality" to enforce password complexity rules. 
 
Install the "pam_pwquality" package by using the following command: 
 
$ sudo apt-get install libpam-pwquality -y 
 Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): 
 
enforcing = 1 
 
Add the following line to "/etc/pam.d/common-password" (or modify the line to have the required value): 
 
password requisite pam_pwquality.so retry=3 
 
Note: The value of "retry" should be between "1" and "3".

The Ubuntu operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.

Description

Remediation - Manual Procedure