Oracle Linux 5 Security Technical Implementation Guide

The Oracle Linux 5 Security Technical Implementation Guide (V2 R1) has 571 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

571STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R1

CurrentPublished Fri Jan 22 2021

The system must require passwords contain a minimum of 15 characters.

Oracle Linux 5 Security Technical Implementation Guide

Assessment Title

Rule Text

The system must require passwords contain a minimum of 15 characters.

Description

Discussion Text

The use of longer passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques by increasing the password search space.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-218227

Rule

SV-218227r603259_rule

Severity

medium

Rule Version

GEN000580

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Check the system password length setting.

Procedure:
Check the password minlen option
# grep pam_cracklib.so /etc/pam.d/system-auth

Confirm the minlen option is set to at least 15 as in the example below:

password required pam_cracklib.so minlen=15

There may be other options on the line. If no such line is found, or the minlen is less than 15 this is a finding.

# grep PASS_MIN_LEN /etc/login.defs

Confirm the PASS_MIN_LEN option is set to at least 15 as in the example below:

PASS_MIN_LEN      15

If this line does not exist, or is less than 15, this is a finding.

Implementation Procedure

Fix Text

Edit "/etc/pam.d/system-auth" to include the line:

password required pam_cracklib.so minlen=15

prior to the "password include system-auth-ac" line.

Edit /etc/login.defs to include the line:

PASS_MIN_LEN      15

STIG check 65 of 571 in the Oracle Linux 5 STIG checklist

← Previous · V-218226The system must not have accounts configured with blank or null passwords.Next · V-218228 →The system must enforce compliance of the entire password during authentication.