documentation_complete: true

prodtype: rhel7,fedora

title: 'Set Password Minimum Length'

description: |-
    The pam_pwquality module's <tt>minlen</tt> parameter controls requirements for
    minimum characters required in a password. Add <tt>minlen=<sub idref="var_password_pam_minlen" /></tt>
    after pam_pwquality to set minimum password length requirements.

rationale: "The shorter the password, the lower the number of possible combinations\nthat need to be tested before the password is compromised.\n<br />\nPassword complexity, or strength, is a measure of the effectiveness of a \npassword in resisting attempts at guessing and brute-force attacks. \nPassword length is one factor of several that helps to determine strength\nand how long it takes to crack a password. Use of more characters in a password\nhelps to exponentially increase the time and/or resources required to \ncompromose the password."

severity: medium

identifiers:
    cce@rhel7: 27293-0

references:
    cis: 6.3.2
    cjis: 5.6.2.1.1
    disa: 205
    nist: IA-5(1)(a)
    ospp@rhel7: FMT_MOF_EXT.1
    pcidss: Req-8.2.3
    srg: SRG-OS-000078-GPOS-00046
    stigid@rhel7: "010280"

ocil_clause: 'minlen is not found, or not equal to or greater than the required value'

ocil: |-
    To check how many characters are required in a password, run the following command:
    <pre>$ grep minlen /etc/security/pwquality.conf</pre>
    Your output should contain <tt>minlen = <sub idref="var_password_pam_minlen" /></tt>
