Title

The system must require passwords contain a minimum of 15 characters. (Cat II impact)

Discussion

The use of longer passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques by increasing the password search space.

Check Content

Check the system password length setting. # grep PASSLENGTH /etc/default/passwd If PASSLENGTH is not set to 15 or more, this is a finding.

Fix Text

Edit /etc/default/passwd and set the PASSLENGTH variable to 15 or greater.

Additional Identifiers

Rule ID: SV-27110r2_rule

Vulnerability ID: V-11947

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.