documentation_complete: true

prodtype: rhel7,fedora

title: 'Set Password Strength Minimum Special Characters'

description: "The pam_pwquality module's <tt>ocredit=</tt> parameter controls requirements for\nusage of special (or \"other\") characters in a password. When set to a negative number, any password will be\nrequired to contain that many special characters. When set to a positive number, pam_pwquality will grant +1 \nadditional length credit for each special character. Modify the <tt>ocredit</tt> setting in \n<tt>/etc/security/pwquality.conf</tt> to equal <sub idref=\"var_password_pam_ocredit\" /> to require use of a special character in passwords."

rationale: "Use of a complex password helps to increase the time and resources required\nto compromise the password. Password complexity, or strength, is a measure of\nthe effectiveness of a password in resisting attempts at guessing and brute-force\nattacks. \n<br /><br />\nPassword complexity is one factor of several that determines how long it takes\nto crack a password. The more complex the password, the greater the number of \npossble combinations that need to be tested before the password is compromised.\nRequiring a minimum number of special characters makes password guessing attacks\nmore difficult by ensuring a larger search space."

severity: medium

identifiers:
    cce@rhel7: 27360-7

references:
    disa: 1619
    nist: IA-5(b),IA-5(c),IA-5(1)(a)
    ospp@rhel7: FMT_MOF_EXT.1
    srg: SRG-OS-000266-GPOS-00101
    stigid@rhel7: "010150"

ocil_clause: 'ocredit is not found or not equal to or less than the required value'

ocil: |-
    To check how many special characters are required in a password, run the following command:
    <pre>$ grep ocredit /etc/security/pwquality.conf</pre>
    The <tt>ocredit</tt> parameter (as a negative number) will indicate how many special characters are required.
    The DoD and FISMA require at least one special character in a password.
    This would appear as <tt>ocredit = -1</tt>.
