The Ubuntu Operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.

An XCCDF Rule

Description

<VulnDiscussion>Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. "pwquality" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-219186r610963_rule
Severity: Medium
References: CCI-000366
Updated: 9 months ago

Configure the operating system to use "pwquality" to enforce password complexity rules.

Install the pam_pwquality package by using the following command:

# apt-get install libpam-pwquality -y
Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value):

enforcing = 1

Add the following line to "/etc/pam.d/common-password" (or modify the line to have the required value):

password requisite pam_pwquality.so retry=3 enforce_for_root

Note: The value of "retry" should be between "1" and "3".

The Ubuntu Operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.

Description

Remediation - Manual Procedure