documentation_complete: true

title: 'Set Password Strength Minimum Lowercase Characters'

description: |-
    The pam_cracklib module's <tt>lcredit=</tt> parameter controls requirements for
    usage of lowercase letters in a password. When set to a negative number, any password will be required to
    contain that many lowercase characters. When set to a positive number, pam_cracklib will grant +1 additional
    length credit for each lowercase character.
    Add <tt>lcredit=-1</tt> after pam_cracklib.so to require use of a lowercase character in passwords.

rationale: |-
    Requiring a minimum number of lowercase characters makes password guessing attacks
    more difficult by ensuring a larger search space.

severity: unknown

identifiers:
    cce: 26631-2

references:
    disa: 193
    nist: IA-5(b),IA-5(c),IA-5(1)(a)
    pcidss: Req-8.2.3
    srg: SRG-OS-000070
    stigid: RHEL-06-000059

ocil_clause: 'lcredit is not found or not set to the required value'

ocil: |-
    To check how many lowercase characters are required in a password, run the following command:
    <pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
    The <tt>lcredit</tt> parameter (as a negative number) will indicate how many special characters are required.
    The DoD and FISMA require at least one lowercase character in a password.
    This would appear as <tt>lcredit=-1</tt>.
