documentation_complete: true

title: 'Set Password Strength Minimum Digit Characters'

description: "The pam_cracklib module's <tt>dcredit</tt> parameter controls requirements for\nusage of digits in a password. When set to a negative number, any password will be required to\ncontain that many digits. When set to a positive number, pam_cracklib will grant +1 additional\nlength credit for each digit.  \nAdd <tt>dcredit=-1</tt> after pam_cracklib.so to require use of a digit in passwords."

rationale: |-
    Requiring digits makes password guessing attacks more difficult by ensuring a larger
    search space.

severity: unknown

identifiers:
    cce: 26374-9

references:
    disa: 194
    nist: IA-5(b),IA-5(c)
    pcidss: Req-8.2.3
    srg: SRG-OS-000071
    stigid: RHEL-06-000056

ocil_clause: 'dcredit is not found or not set to the required value'

ocil: |-
    To check how many digits are required in a password, run the following command:
    <pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
    The <tt>dcredit</tt> parameter (as a negative number) will indicate how many digits are required.
    The DoD requires at least one digit in a password.
    This would appear as <tt>dcredit=-1</tt>.
