User passwords must be at least 15 characters in length.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-216324 | SRG-OS-000078 | SOL-11.1-040040 | SV-216324r1016270_rule | 2024-11-25 | 3 |
| Description |
|---|
| Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password is, the lower the number of possible combinations that need to be tested before the password is compromised. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password. |
| ℹ️ Check |
|---|
| Check the system password length setting. # grep ^PASSLENGTH /etc/default/passwd If PASSLENGTH is not set to 15 or more, this is a finding. |
| ✔️ Fix |
|---|
| The root role is required. # pfedit /etc/default/passwd Locate the line containing: PASSLENGTH Change the line to read: PASSLENGTH=15 |