Check: GEN000580
AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE:
GEN000580
(in versions v1 r14 through v1 r10)
Title
The system must require passwords to contain a minimum of 15 characters. (Cat II impact)
Discussion
The use of longer passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques by increasing the password search space.
Check Content
Check the system password length setting. # /usr/sbin/lsuser -a minlen ALL If minlen is not set to 15 or more, this is a finding.
Fix Text
Change the minimum password length to 15 or more. # chsec -f /etc/security/user -s default -a minlen=15 # chuser minlen=15 <user id>
Additional Identifiers
Rule ID: SV-38936r2_rule
Vulnerability ID: V-11947
Group Title: GEN000580
Expert Comments
Expert comments are only available to logged-in users.
CCIs
CCIs tied to check.
Number | Definition |
---|---|
CCI-000205 |
The information system enforces minimum password length. |
Controls
Controls tied to check. These are derived from the CCIs shown above.
Number | Title |
---|---|
IA-5 (1) |
Password-Based Authentication |