documentation_complete: true

title: 'Set Password Minimum Length'

description: |-
    The pam_cracklib module's <tt>minlen</tt> parameter controls requirements for
    minimum characters required in a password. Add <tt>minlen=<sub idref="var_password_pam_minlen" /></tt>
    after pam_pwquality to set minimum password length requirements.

rationale: |-
    Password length is one factor of several that helps to determine
    strength and how long it takes to crack a password. Use of more characters in
    a password helps to exponentially increase the time and/or resources
    required to compromise the password.

severity: unknown

identifiers:
    cce: 26615-5

references:
    disa: 205
    nist: IA-5(1)(a)
    pcidss: Req-8.2.3

ocil_clause: 'minlen is not found or not set to the required value (or higher)'

ocil: |-
    To check how many characters are required in a password, run the following command:
    <pre>$ grep cracklib /etc/pam.d/system-auth</pre>
    Your output should contain <tt>minlen=<sub idref="var_password_pam_minlen" /></tt>
