Check: RIIM-OS-611045
Riverbed NetIM OS STIG:
RIIM-OS-611045
(in version v1 r1)
Title
Ubuntu OS must be configured so that when passwords are changed or new passwords are established, pwquality must be used. (Cat II impact)
Discussion
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. "pwquality" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system. Satisfies: SRG-OS-000710-GPOS-00160, SRG-OS-000725-GPOS-00180, SRG-OS-000730-GPOS-00190, SRG-OS-000480-GPOS-00225
Check Content
Verify Ubuntu OS enforces password complexity rules by using the following command: $ grep -i enforcing /etc/security/pwquality.conf enforcing = 1 If "enforcing" is not "1", is commented out, or is missing, this is a finding. Check for the use of "pwquality" by using the following command: $ cat /etc/pam.d/common-password | grep requisite | grep pam_pwquality password requisite pam_pwquality.so retry=3 If "retry" is set to "0" or is greater than "3", or is missing, this is a finding.
Fix Text
Configure Ubuntu OS to enforce password complexity rules. Add or modify the following line in the "/etc/security/pwquality.conf" file: enforcing = 1 Add or modify the following line in the "/etc/pam.d/common-password" file: password requisite pam_pwquality.so retry=3 Note: The value of "retry" should be between "1" and "3".
Additional Identifiers
Rule ID: SV-275656r1148018_rule
Vulnerability ID: V-275656
Group Title: SRG-OS-000710-GPOS-00160
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000366 |
Implement the security configuration settings. |
| CCI-004061 |
For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a). |
| CCI-004064 |
For password-based authentication, allow user selection of long passwords and passphrases, including spaces and all printable characters. |
| CCI-004065 |
For password-based authentication, employ automated tools to assist the user in selecting strong password authenticators. |