Skip to content

5.3.3.2.2 Ensure minimum password length is configured

Audit#

Run the following command to verify that password length is 14 or more characters, and conforms to local site policy: 

# grep -Psi -- '^\h*minlen\h*=\h*(1[4-9]|[2-9][0-9]|[1-9][0-9]{2,})\b' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf

Example output: 

/etc/security/pwquality.conf.d/50-pwlength.conf:minlen = 14

Verify returned value(s) are no less than 14 characters and meet local site policy Run the following command to verify that minlen is not set, or is 14 or more characters, and conforms to local site policy: 

# grep -Psi -- '^\h*password\h+(requisite|required|sufficient)\h+pam_pwquality\.so\h+([^#\n\r]+\h+)?minlen\h*=\h*([0-9]|1[0-3])\b' /etc/pam.d/system-auth /etc/pam.d/common-password
Nothing should be returned

Note: - settings should be configured in only one location for clarity - Settings observe an order of precedence: - module arguments override the settings in the /etc/security/pwquality.conf configuration file - settings in the /etc/security/pwquality.conf configuration file override settings in a .conf file in the /etc/security/pwquality.conf.d/ directory - settings in a .conf file in the /etc/security/pwquality.conf.d/ directory are read in canonical order, with last read file containing the setting taking precedence - It is recommended that settings be configured in a .conf file in the /etc/security/pwquality.conf.d/ directory for clarity, convenience, and durability.

Remediation#

Create or modify a file ending in .conf in the /etc/security/pwquality.conf.d/ directory or the file /etc/security/pwquality.conf and add or modify the following line to set password length of 14 or more characters. Ensure that password length conforms to local site policy: Example: 

1
2
3
4
5
6
#!/usr/bin/env bash
{
sed -ri 's/^\s*minlen\s*=/# &/' /etc/security/pwquality.conf
[ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/
printf '\n%s' "minlen = 14" > /etc/security/pwquality.conf.d/50-pwlength.conf
}

Run the following command: 

# grep -Pl -- '\bpam_pwquality\.so\h+([^#\n\r]+\h+)?minlen\b' /usr/share/pam-configs/*

Edit any returned files and remove the minlen argument from the pam_pwquality.so line(s):

Default Value: minlen = 8