BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

RHEL-10-600620 RHEL 10 must ensure the password complexity module is enabled in the "password-auth" file.

DISA STIG library V1R3
All changes in this version
first version loaded CAT II

Maps to IA-5(1) via CCI-004066

Title

RHEL 10 must ensure the password complexity module is enabled in the "password-auth" file.

Control

Verify RHEL 10 uses "pwquality" to enforce the password complexity rules in the "password-auth" file with the following command: $ sudo grep pam_pwquality /etc/pam.d/password-auth password required pam_pwquality.so If the command does not return a line containing the value "pam_pwquality.so", or the line is commented out, this is a finding. If the system administrator can demonstrate that the required configuration is contained in a PAM configuration file included or substacked from the "system-auth" file, this is not a finding.

Discussion

Enabling Pluggable Authentication Module (PAM) password complexity permits enforcement of strong passwords and consequently makes the system less prone to dictionary attacks. Satisfies: SRG-OS-000069-GPOS-00037, SRG-OS-000070-GPOS-00038

Related controls

CCI-004066

Fix

Configure RHEL 10 to use "pwquality" to enforce password complexity rules. Add the following line to the "/etc/pam.d/password-auth" file (or modify the line to have the required value): password required pam_pwquality.so