documentation_complete: true

prodtype: rhel7,fedora

title: 'Set Password Strength Minimum Lowercase Characters'

description: "The pam_pwquality module's <tt>lcredit</tt> parameter controls requirements for\nusage of lowercase letters in a password. When set to a negative number, any password will be required to\ncontain that many lowercase characters. When set to a positive number, pam_pwquality will grant +1 additional\nlength credit for each lowercase character. Modify the <tt>lcredit</tt> setting in \n<tt>/etc/security/pwquality.conf</tt> to require the use of a lowercase character in passwords."

rationale: "Use of a complex password helps to increase the time and resources required\nto compromise the password. Password complexity, or strength, is a measure of\nthe effectiveness of a password in resisting attempts at guessing and brute-force\nattacks. \n<br /><br />\nPassword complexity is one factor of several that determines how long it takes\nto crack a password. The more complex the password, the greater the number of \npossble combinations that need to be tested before the password is compromised.\nRequiring a minimum number of lowercase characters makes password guessing attacks\nmore difficult by ensuring a larger search space."

severity: medium

identifiers:
    cce@rhel7: 27345-8

references:
    disa: 193
    nist: IA-5(b),IA-5(c),IA-5(1)(a)
    ospp@rhel7: FMT_MOF_EXT.1
    pcidss: Req-8.2.3
    srg: SRG-OS-000070-GPOS-00038
    stigid@rhel7: "010130"

ocil_clause: 'lcredit is not found or not less than or equal to the required value'

ocil: |-
    To check how many lowercase characters are required in a password, run the following command:
    <pre>$ grep lcredit /etc/security/pwquality.conf</pre>
    The <tt>lcredit</tt> parameter (as a negative number) will indicate how many special characters are required.
    The DoD and FISMA require at least one lowercase character in a password. This would appear as <tt>lcredit = -1</tt>.
