Skip to content
ATO Pathways
Log In
Overview
Search
Catalogs
SCAP
OSCAL
Catalogs
Profiles
Resources
Documents
Publishers
References
Knowledge Base
Platform Documentation
Compliance Dictionary
Platform Changelog
About
Catalogs
XCCDF
CloudLinux AlmaLinux OS 9 Security Technical Implementation Guide
SRG-OS-000078-GPOS-00046
SRG-OS-000078-GPOS-00046
An XCCDF Group - A logical subset of the XCCDF Benchmark
Details
Profiles
Prose
SRG-OS-000078-GPOS-00046
1 Rule
AlmaLinux OS 9 passwords must be created with a minimum of 15 characters.
Medium Severity
The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password. The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password. AlmaLinux OS 9 uses the PAM pwquality module as a mechanism to enforce password complexity. Configurations are set in the "/etc/security/pwquality.conf" file or further *.conf files within the "/etc/security/pwquality.conf.d/" directory. The "minlen" parameter acts as a score of complexity based on the credit components of the pwquality module. By setting the credit to a negative value, not only will those components be required, but they will not count toward the total score of minlen. This will result in minlen requiring a 15-character minimum.