Set Password Minimum Length in login.defs
An XCCDF Rule
Description
To specify password length requirements for new accounts, edit the file
/etc/login.defs and add or correct the following line:
PASS_MIN_LEN
The DoD requirement is
15.
The FISMA requirement is 12.
The profile requirement is
/etc/login.defs and also another PAM module
(such as pam_pwquality) during a password change operation, then
the most restrictive must be satisfied. See PAM section for more
information about enforcing password quality requirements.
Rationale
Requiring a minimum password length makes password cracking attacks more difficult by ensuring a larger search space. However, any security benefit from an onerous requirement must be carefully weighed against usability problems, support costs, or counterproductive behavior that may result.
- ID
- xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs
- Severity
- Medium
- References
- Updated