The Photon operating system must enforce password complexity on the root account.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-258897	SRG-OS-000480-GPOS-00227	PHTN-40-000235	SV-258897r991589_rule	2024-07-11	2

Description
Password complexity rules must apply to all accounts on the system, including root. Without specifying the enforce_for_root flag, pam_pwquality does not apply complexity rules to the root user. While root users can find ways around this requirement, given its superuser power, it is necessary to attempt to force compliance.

ℹ️ Check
At the command line, run the following command to verify password complexity is enforced for the root account: # grep '^password.*pam_pwquality.so' /etc/pam.d/system-password Example result: password requisite pam_pwquality.so dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 minlen=15 difok=8 enforce_for_root dictcheck=1 If the "enforce_for_root" option is missing or commented out, this is a finding.

✔️ Fix
Navigate to and open: /etc/pam.d/system-password Configure the pam_pwquality.so line to have the "enforce_for_root" option present as follows: password requisite pam_pwquality.so dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 minlen=15 difok=8 enforce_for_root dictcheck=1 Note: On vCenter appliances, the equivalent file must be edited under "/etc/applmgmt/appliance", if one exists, for the changes to persist after a reboot.

✔️ Fix

Navigate to and open: /etc/pam.d/system-password Configure the pam_pwquality.so line to have the "enforce_for_root" option present as follows: password requisite pam_pwquality.so dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 minlen=15 difok=8 enforce_for_root dictcheck=1 Note: On vCenter appliances, the equivalent file must be edited under "/etc/applmgmt/appliance", if one exists, for the changes to persist after a reboot.