documentation_complete: true

title: 'Set Password Minimum Length in login.defs'

description: |-
    To specify password length requirements for new accounts,
    edit the file <tt>/etc/login.defs</tt> and add or correct the following
    lines:
    <pre>PASS_MIN_LEN <sub idref="var_accounts_password_minlen_login_defs" /></pre>
    <br /><br />
    As of the DISA Red Hat 6 STIG - Ver 1, Rel 13 (28-OCT-2016), the DoD requirement is now <tt>15</tt>.
    The FISMA requirement is <tt>12</tt>.
    If a program consults <tt>/etc/login.defs</tt> and also another PAM module
    (such as <tt>pam_cracklib</tt>) during a password change operation,
    then the most restrictive must be satisfied. See PAM section
    for more information about enforcing password quality requirements.

rationale: |-
    Requiring a minimum password length makes password
    cracking attacks more difficult by ensuring a larger
    search space. However, any security benefit from an onerous requirement
    must be carefully weighed against usability problems, support costs, or counterproductive
    behavior that may result.

severity: medium

identifiers:
    cce: 27002-5

references:
    disa: 205
    nist: IA-5(f),IA-5(1)(a)
    srg: SRG-OS-000078
    stigid: RHEL-06-000050

ocil_clause: 'it is not set to the required value'

ocil: |-
    To check the minimum password length, run the command:
    <pre>$ grep PASS_MIN_LEN /etc/login.defs</pre>
    The DoD requirement is <tt>15</tt>.
