documentation_complete: true

title: 'Set Password Strength Minimum Different Categories'

description: |-
    The pam_cracklib module's <tt>minclass</tt> parameter controls requirements for
    usage of different character classes, or types, of character that must exist in a password
    before it is considered valid. For example, setting this value to three (3) requires that
    any password must have characters from at least three different categories in order to be
    approved. The default value is zero (0), meaning there are no required classes. There are
    four categories available:
    <pre>
    * Upper-case characters
    * Lower-case characters
    * Digits
    * Special characters (for example, punctuation)
    </pre>
    Add <tt>minclass=<i><sub idref="var_password_pam_minclass" /></i></tt> after pam_cracklib.so entry into the
    <tt>/etc/pam.d/system-auth</tt> file in order to require <sub idref="var_password_pam_minclass" />  differing categories of
    characters when changing passwords.
    For example to require at least three character classes to be used in password, use <tt>minclass=3</tt>.

rationale: |-
    Requiring a minimum number of character categories makes password guessing attacks
    more difficult by ensuring a larger search space.

severity: unknown

identifiers:
    cce: CCE-27115-5

ocil_clause: 'minclass is not found or not set to the required value'

ocil: |-
    To check how many categories of characters must be used in password during a password change,
    run the following command:
    <pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
    The <tt>minclass</tt> parameter will indicate how many character classes must be used. If
    the requirement was for the password to contain characters from three different categories,
    then this would appear as <tt>minclass=3</tt>.
