documentation_complete: true

prodtype: rhel7,fedora

title: 'Set Password Minimum Length in login.defs'

description: "To specify password length requirements for new accounts,\nedit the file <tt>/etc/login.defs</tt> and add or correct the following\nline:\n<pre>PASS_MIN_LEN <sub idref=\"var_accounts_password_minlen_login_defs\" /></pre>\n<br /><br />\nThe DoD requirement is <tt>15</tt>. \nThe FISMA requirement is <tt>12</tt>.\nThe profile requirement is <tt><sub idref=\"var_accounts_password_minlen_login_defs\" /></tt>.\nIf a program consults <tt>/etc/login.defs</tt> and also another PAM module\n(such as <tt>pam_pwquality</tt>) during a password change operation,\nthen the most restrictive must be satisfied. See PAM section\nfor more information about enforcing password quality requirements."

rationale: |-
    Requiring a minimum password length makes password
    cracking attacks more difficult by ensuring a larger
    search space. However, any security benefit from an onerous requirement
    must be carefully weighed against usability problems, support costs, or counterproductive
    behavior that may result.

severity: medium

identifiers:
    cce@rhel7: 27123-9

references:
    cjis: 5.6.2.1
    cui: 3.5.7
    disa: ""
    nist: IA-5(f),IA-5(1)(a)
    ospp@rhel7: FMT_MOF_EXT.1

ocil_clause: 'it is not set to the required value'

ocil: |-
    To check the minimum password length, run the command:
    <pre>$ grep PASS_MIN_LEN /etc/login.defs</pre>
    The DoD requirement is <tt>15</tt>.
