`IA-05(01)` Password-based Authentication

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version

unchanged IA Low baseline Moderate baseline High baseline part of IA-5

Title

Password-based Authentication

Control

For password-based authentication:
(a) Maintain a list of commonly-used, expected, or compromised passwords and update the list [Assignment: frequency] and when organizational passwords are suspected to have been compromised directly or indirectly;
(b) Verify, when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5(1)(a);
(c) Transmit passwords only over cryptographically-protected channels;
(d) Store passwords using an approved salted key derivation function, preferably using a keyed hash;
(e) Require immediate selection of a new password upon account recovery;
(f) Allow user selection of long passwords and passphrases, including spaces and all printable characters;
(g) Employ automated tools to assist the user in selecting strong password authenticators; and
(h) Enforce the following composition and complexity rules: [Assignment: composition and complexity rules].

Discussion

Password-based authentication applies to passwords regardless of whether they are used in single-factor or multi-factor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.

Parameters

ia-05.01_odp.01: frequency
ia-05.01_odp.02: composition and complexity rules

Related controls

ia-6

STIG rules that implement this control 148

Apple iOS/iPadOS 26 V1R3

AIOS-26-006500 CAT II Apple iOS/iPadOS 26 must be configured to enforce a minimum password length of six characters.
AIOS-26-006600 CAT II Apple iOS/iPadOS 26 must be configured to not allow passwords that include more than four repeating or sequential characters.
AIOS-26-006950 CAT I Apple iOS/iPadOS 26 must be configured to enforce a passcode reuse prohibition of at least two generations.

Apple iOS/iPadOS 27 V1R1

AIOS-27-006000 CAT II Apple iOS/iPadOS 27 (MOS) must be configured to enforce a minimum password length of six characters.
AIOS-27-006100 CAT II Apple iOS/iPadOS 27 (MOS) must be configured to not allow passwords that include more than four repeating or sequential characters.
AIOS-27-006500 CAT I Apple iOS/iPadOS 27 must be configured to enforce a passcode reuse prohibition of at least two generations.

Apple macOS 15 (Sequoia) V1R8

APPL-15-002038 CAT I The macOS system must disable Trivial File Transfer Protocol (TFTP) service.
APPL-15-003007 CAT II The macOS system must require that passwords contain a minimum of one numeric character.
APPL-15-003008 CAT II The macOS system must restrict maximum password lifetime to 180 days.
APPL-15-003010 CAT II The macOS system must require a minimum password length of 14 characters.
APPL-15-003011 CAT II The macOS system must require that passwords contain a minimum of one special character.
APPL-15-003060 CAT II The macOS system must require that passwords contain a minimum of one lowercase character and one uppercase character.
APPL-15-003070 CAT II The macOS system must set minimum password lifetime to 24 hours.

Apple macOS 26 (Tahoe) V1R4

APPL-26-002038 CAT I The macOS system must disable Trivial File Transfer Protocol (TFTP) service.
APPL-26-003007 CAT II The macOS system must require that passwords contain a minimum of one numeric character.
APPL-26-003008 CAT II The macOS system must restrict maximum password lifetime to 180 days.
APPL-26-003010 CAT II The macOS system must require a minimum password length of 14 characters.
APPL-26-003011 CAT II The macOS system must require that passwords contain a minimum of one special character.
APPL-26-003060 CAT II The macOS system must require that passwords contain a minimum of one lowercase character and one uppercase character.
APPL-26-003070 CAT II The macOS system must set minimum password lifetime to 24 hours.

Application Security and Development V6R5

APSC-DV-001680 CAT I The application must enforce a minimum 15-character password length.
APSC-DV-001690 CAT II The application must enforce password complexity by requiring that at least one uppercase character be used.
APSC-DV-001700 CAT II The application must enforce password complexity by requiring that at least one lowercase character be used.
APSC-DV-001710 CAT II The application must enforce password complexity by requiring that at least one numeric character be used.
APSC-DV-001720 CAT II The application must enforce password complexity by requiring that at least one special character be used.
APSC-DV-001730 CAT II The application must require the change of at least eight of the total number of characters when passwords are changed.
APSC-DV-001740 CAT I The application must only store cryptographic representations of passwords.
APSC-DV-001750 CAT I The application must transmit only cryptographically-protected passwords.
APSC-DV-001760 CAT II The application must enforce 24 hours/1 day as the minimum password lifetime.
APSC-DV-001770 CAT II The application must enforce a 180-day maximum password lifetime restriction.
APSC-DV-001780 CAT II The application must prohibit password reuse for a minimum of five generations.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-215035 CAT I Ubuntu 22.04 LTS must not have the "telnet" package installed.
UBTU-22-411025 CAT II Ubuntu 22.04 LTS must enforce 24 hours/one day as the minimum password lifetime. Passwords for new users must have a 24 hours/one day minimum password lifetime restriction.
UBTU-22-411030 CAT II Ubuntu 22.04 LTS must be able to enforce a 180-day maximum password lifetime restriction.
UBTU-22-611010 CAT II Ubuntu 22.04 LTS must enforce password complexity by requiring at least one uppercase character be used.
UBTU-22-611015 CAT II Ubuntu 22.04 LTS must enforce password complexity by requiring at least one lowercase character be used.
UBTU-22-611020 CAT II Ubuntu 22.04 LTS must enforce password complexity by requiring that at least one numeric character be used.
UBTU-22-611025 CAT II Ubuntu 22.04 LTS must enforce password complexity by requiring that at least one special character be used.
UBTU-22-611035 CAT II Ubuntu 22.04 LTS must enforce a minimum 15-character password length.
UBTU-22-611040 CAT II Ubuntu 22.04 LTS must require the change of at least eight characters when passwords are changed.
UBTU-22-611055 CAT II Ubuntu 22.04 LTS must store only encrypted representations of passwords.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-100030 CAT I Ubuntu 24.04 LTS must not have the telnet package installed.
UBTU-24-300014 CAT II Ubuntu 24.04 LTS must prevent the use of dictionary words for passwords.
UBTU-24-400220 CAT II Ubuntu 24.04 LTS must store only encrypted representations of passwords.
UBTU-24-400260 CAT II Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one uppercase character be used.
UBTU-24-400270 CAT II Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one lowercase character be used.
UBTU-24-400280 CAT II Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one numeric character be used.
UBTU-24-400290 CAT II Ubuntu 24.04 LTS must require the change of at least eight characters when passwords are changed.
UBTU-24-400300 CAT II Ubuntu 24.04 LTS must enforce 24 hours/1 day as the minimum password lifetime. Passwords for new users must have a 24 hours/1 day minimum password lifetime restriction.
UBTU-24-400310 CAT II Ubuntu 24.04 LTS must be able to enforce a 180-day maximum password lifetime restriction.
UBTU-24-400320 CAT II Ubuntu 24.04 LTS must enforce a minimum 15-character password length.
UBTU-24-400330 CAT II Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one special character be used.

Cisco IOS XE Router NDM Y26M04

CISC-ND-000550 CAT II The Cisco router must be configured to enforce a minimum 15-character password length.
CISC-ND-000570 CAT II The Cisco router must be configured to enforce password complexity by requiring that at least one uppercase character be used.
CISC-ND-000580 CAT II The Cisco router must be configured to enforce password complexity by requiring that at least one lowercase character be used.
CISC-ND-000590 CAT II The Cisco router must be configured to enforce password complexity by requiring that at least one numeric character be used.
CISC-ND-000600 CAT II The Cisco router must be configured to enforce password complexity by requiring that at least one special character be used.
CISC-ND-000610 CAT II The Cisco router must be configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password.
CISC-ND-000620 CAT I The Cisco router must only store cryptographic representations of passwords.

Google Android 16 COBO Y26M10

GOOG-16-006000 CAT II Google Android 16 must be configured to enforce a minimum password length of six characters.
GOOG-16-006100 CAT II Google Android 16 must be configured to not allow passwords that include more than four repeating or sequential characters.

Google Android 17 COBO Y26M06

GOOG-17-005000 CAT II Google Android 17 must be configured to enforce a minimum password length of six characters.
GOOG-17-005100 CAT II Google Android 17 must be configured to not allow passwords that include more than four repeating or sequential characters.

Microsoft Windows 11 V2R11

WN11-00-000090 CAT II Accounts must be configured to require password expiration.
WN11-AC-000020 CAT II The password history must be configured to 24 passwords remembered.
WN11-AC-000025 CAT II The maximum password age must be configured to 180 days or less.
WN11-AC-000030 CAT II The minimum password age must be configured to at least 1 day.
WN11-AC-000035 CAT II Passwords must, at a minimum, be 14 characters.
WN11-AC-000040 CAT II The built-in Microsoft password complexity filter must be enabled.
WN11-AC-000045 CAT I Reversible password encryption must be disabled.
WN11-SO-000110 CAT II Unencrypted passwords must not be sent to third-party SMB Servers.
WN11-SO-000195 CAT I The system must be configured to prevent the storage of the LAN Manager hash of passwords.
WN11-SO-000280 CAT II Passwords for enabled local Administrator accounts must be changed at least every 180 days.

Microsoft Windows Server 2022 V2R11

WN22-00-000020 CAT II Windows Server 2022 passwords for the built-in Administrator account must be changed at least every 180 days.
WN22-00-000050 CAT II Windows Server 2022 manually managed application account passwords must be at least 14 characters in length.
WN22-00-000210 CAT II Windows Server 2022 passwords must be configured to expire.
WN22-AC-000040 CAT II Windows Server 2022 password history must be configured to 24 passwords remembered.
WN22-AC-000050 CAT II Windows Server 2022 maximum password age must be configured to 180 days or less.
WN22-AC-000060 CAT II Windows Server 2022 minimum password age must be configured to at least one day.
WN22-AC-000070 CAT II Windows Server 2022 minimum password length must be configured to 14 characters.
WN22-AC-000080 CAT II Windows Server 2022 must have the built-in Windows password complexity policy enabled.
WN22-AC-000090 CAT I Windows Server 2022 reversible password encryption must be disabled.
WN22-SO-000180 CAT II Windows Server 2022 unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers.
WN22-SO-000300 CAT I Windows Server 2022 must be configured to prevent the storage of the LAN Manager hash of passwords.

Microsoft Windows Server 2025 V1R4

WN25-00-000020 CAT II Windows Server 2025 passwords for the built-in Administrator account must be changed at least every 180 days.
WN25-00-000050 CAT II Windows Server 2025 manually managed application account passwords must be at least 15 characters in length.
WN25-00-000210 CAT II Windows Server 2025 passwords must be configured to expire.
WN25-AC-000040 CAT II Windows Server 2025 password history must be configured to 24 passwords remembered.
WN25-AC-000050 CAT II Windows Server 2025 maximum password age must be configured to 180 days or less.
WN25-AC-000060 CAT II Windows Server 2025 minimum password age must be configured to at least one day.
WN25-AC-000080 CAT II Windows Server 2025 must have the built-in Windows password complexity policy enabled.
WN25-AC-000090 CAT I Windows Server 2025 reversible password encryption must be disabled.
WN25-SO-000180 CAT II Windows Server 2025 unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-200070 CAT I RHEL 10 must not have the "tftp" package installed.
RHEL-10-200090 CAT I RHEL 10 must not have a File Transfer Protocol (FTP) server package installed.
RHEL-10-600100 CAT II RHEL 10 user account passwords for new users or password changes must have a 180-day maximum password lifetime restriction in /etc/login.defs.
RHEL-10-600110 CAT II RHEL 10 must, for user account passwords, have a 180-day maximum password lifetime restriction
RHEL-10-600210 CAT II RHEL 10 must enforce a 24-hours minimum password lifetime restriction for passwords for new users or password changes in "/etc/login.defs".
RHEL-10-600220 CAT II RHEL 10 must enforce that passwords be created with a minimum of 15 characters.
RHEL-10-600230 CAT II RHEL 10 must enforce password complexity by requiring at least one special character to be used.
RHEL-10-600240 CAT II RHEL 10 must enforce password complexity by requiring that at least one lowercase character be used.
RHEL-10-600250 CAT II RHEL 10 must enforce password complexity by requiring that at least one uppercase character be used.
RHEL-10-600260 CAT II RHEL 10 must require the change of at least eight characters when passwords are changed.
RHEL-10-600270 CAT II RHEL 10 must enforce that passwords have a 24 hours/1 day minimum lifetime restriction in "/etc/shadow".
RHEL-10-600280 CAT II RHEL 10 must require the maximum number of repeating characters of the same character class to be limited to four when passwords are changed.
RHEL-10-600290 CAT II RHEL 10 must require that the maximum number of repeating characters be limited to three when passwords are changed.
RHEL-10-600300 CAT II RHEL 10 must require the change of at least four character classes when passwords are changed.
RHEL-10-600310 CAT II RHEL 10 must enforce password complexity by requiring that at least one numeric character be used.
RHEL-10-600320 CAT II RHEL 10 must prevent the use of dictionary words for passwords.
RHEL-10-600405 CAT II RHEL 10 must enforce password complexity rules for the "root" account.
RHEL-10-600455 CAT II RHEL 10 must not allow blank or null passwords.
RHEL-10-600460 CAT II RHEL 10 must not have accounts configured with blank or null passwords.
RHEL-10-600485 CAT II RHEL 10 must ensure the password complexity module in the system-auth file is configured for three or fewer retries.
RHEL-10-600620 CAT II RHEL 10 must ensure the password complexity module is enabled in the "password-auth" file.
RHEL-10-600630 CAT II RHEL 10 must ensure the password complexity module is enabled in the "system-auth" file.
RHEL-10-600650 CAT II RHEL 10 must ensure that the pam_unix.so module is configured in the password-auth file to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication.
RHEL-10-600700 CAT II RHEL 10 must be configured to use a sufficient number of hashing rounds for the shadow password suite.
RHEL-10-600710 CAT II RHEL 10 must be configured to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication by ensuring that the pam_unix.so module is configured in the "system-auth" file.
RHEL-10-600720 CAT II RHEL 10 must be configured so that password-auth uses a sufficient number of hashing rounds.
RHEL-10-600730 CAT I RHEL 10 must employ FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords.
RHEL-10-600740 CAT I RHEL 10 must be configured to use the shadow file to store only encrypted representations of passwords.
RHEL-10-600750 CAT I RHEL 10 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.
RHEL-10-800310 CAT II RHEL 10 must be configured to operate in secure mode if the Trivial File Transfer Protocol (TFTP) server service is required.

Red Hat Enterprise Linux 9 V2R10

RHEL-09-215015 CAT I RHEL 9 must not have a File Transfer Protocol (FTP) server package installed.
RHEL-09-411010 CAT II RHEL 9 user account passwords for new users or password changes must have a 180-day maximum password lifetime restriction in /etc/login.defs.
RHEL-09-411015 CAT II RHEL 9 user account passwords must have a 180-day maximum password lifetime restriction.
RHEL-09-611010 CAT II RHEL 9 must ensure the password complexity module in the system-auth file is configured for three retries or less.
RHEL-09-611040 CAT II RHEL 9 must ensure the password complexity module is enabled in the password-auth file.
RHEL-09-611050 CAT II RHEL 9 password-auth must be configured to use a sufficient number of hashing rounds.
RHEL-09-611055 CAT II RHEL 9 system-auth must be configured to use a sufficient number of hashing rounds.
RHEL-09-611060 CAT II RHEL 9 must enforce password complexity rules for the root account.
RHEL-09-611065 CAT II RHEL 9 must enforce password complexity by requiring that at least one lowercase character be used.
RHEL-09-611070 CAT II RHEL 9 must enforce password complexity by requiring that at least one numeric character be used.
RHEL-09-611075 CAT II RHEL 9 passwords for new users or password changes must have a 24 hours minimum password lifetime restriction in /etc/login.defs.
RHEL-09-611080 CAT II RHEL 9 passwords must have a 24 hours minimum password lifetime restriction in /etc/shadow.
RHEL-09-611090 CAT II RHEL 9 passwords must be created with a minimum of 15 characters.
RHEL-09-611100 CAT II RHEL 9 must enforce password complexity by requiring that at least one special character be used.
RHEL-09-611110 CAT II RHEL 9 must enforce password complexity by requiring that at least one uppercase character be used.
RHEL-09-611115 CAT II RHEL 9 must require the change of at least eight characters when passwords are changed.
RHEL-09-611120 CAT II RHEL 9 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed.
RHEL-09-611125 CAT II RHEL 9 must require the maximum number of repeating characters be limited to three when passwords are changed.
RHEL-09-611130 CAT II RHEL 9 must require the change of at least four character classes when passwords are changed.
RHEL-09-611135 CAT II RHEL 9 must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.
RHEL-09-611140 CAT II RHEL 9 must be configured to use the shadow file to store only encrypted representations of passwords.
RHEL-09-671015 CAT II RHEL 9 must employ FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords.
RHEL-09-671025 CAT II RHEL 9 pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.

Samsung Android 16 COBO Y26M10

KNOX-16-004900 CAT II Samsung Android must be configured to enforce a minimum password length of six characters.
KNOX-16-005000 CAT II Samsung Android must be configured to not allow passwords that include more than four repeating or sequential characters.

IA-05(01) Password-based Authentication