documentation_complete: true

prodtype: rhel7,fedora

title: 'Set Password Strength Minimum Digit Characters'

description: "The pam_pwquality module's <tt>dcredit</tt> parameter controls requirements for\nusage of digits in a password. When set to a negative number, any password will be required to\ncontain that many digits. When set to a positive number, pam_pwquality will grant +1 additional\nlength credit for each digit. Modify the <tt>dcredit</tt> setting in \n<tt>/etc/security/pwquality.conf</tt> to require the use of a digit in passwords."

rationale: "Use of a complex password helps to increase the time and resources required\nto compromise the password. Password complexity, or strength, is a measure of\nthe effectiveness of a password in resisting attempts at guessing and brute-force\nattacks. \n<br /><br />\nPassword complexity is one factor of several that determines how long it takes\nto crack a password. The more complex the password, the greater the number of \npossble combinations that need to be tested before the password is compromised.\nRequiring digits makes password guessing attacks more difficult by ensuring a larger\nsearch space."

severity: medium

identifiers:
    cce@rhel7: 27214-6

references:
    cis: 6.3.2
    disa: 194
    nist: IA-5(1)(a),IA-5(b),IA-5(c),194
    ospp@rhel7: FMT_MOF_EXT.1
    pcidss: Req-8.2.3
    srg: SRG-OS-000071-GPOS-00039
    stigid@rhel7: "010140"

ocil_clause: 'dcredit is not found or not equal to or less than the required value'

ocil: |-
    To check how many digits are required in a password, run the following command:
    <pre>$ grep dcredit /etc/security/pwquality.conf</pre>
    The <tt>dcredit</tt> parameter (as a negative number) will indicate how many digits are required.
    The DoD requires at least one digit in a password. This would appear as <tt>dcredit = -1</tt>.
