Check: GEN000580
AIX 5.3 STIG:
GEN000580
(in version v1 r3)
Title
The system must require passwords to contain a minimum of 14 characters. (Cat II impact)
Discussion
The use of longer passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques by increasing the password search space.
Check Content
Check the system password length setting. # /usr/sbin/lsuser -a minlen ALL If minlen is not set to 14 or more, this is a finding.
Fix Text
Change the minimum password length to 14 or more. # chsec -f /etc/security/user -s default -a minlen=14 # chuser minlen=14 <user id>
Additional Identifiers
Rule ID: SV-38936r1_rule
Vulnerability ID: V-11947
Group Title:
Expert Comments
Expert comments are only available to logged-in users.
CCIs
CCIs tied to check.
Number | Definition |
---|---|
CCI-000205 |
The information system enforces minimum password length. |
Controls
Controls tied to check. These are derived from the CCIs shown above.
Number | Title |
---|---|
IA-5 (1) |
Password-Based Authentication |