Title

A minimum password length must be set. (Cat II impact)

Discussion

Information systems not protected with strong password schemes including passwords of minimum length provide the opportunity for anyone to crack the password and gain access to the system, and cause the device, information, or the local network to be compromised or a Denial of Service.

Check Content

Open a terminal session and enter the following command to view the setting for minimum password length. sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep minChars If the value of minChars is less than 15, this is a finding. NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems. pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep minChars If the value of minChars is less than 15, this is a finding.

Fix Text

Open a terminal session and use the following command to set the value for minimum password length. sudo pwpolicy -n -setglobalpolicy "minChars=15" NOTE: For non-managed system, use the following command. pwpolicy -n /Local/Default -setglobalpolicy "minChars=15"

Additional Identifiers

Rule ID: SV-37172r1_rule

Vulnerability ID: V-25230

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.