documentation_complete: true

prodtype: rhel7,fedora

title: 'Set Password Strength Minimum Uppercase Characters'

description: |-
    The pam_pwquality module's <tt>ucredit=</tt> parameter controls requirements for
    usage of uppercase letters in a password. When set to a negative number, any password will be required to
    contain that many uppercase characters. When set to a positive number, pam_pwquality will grant +1 additional
    length credit for each uppercase character. Modify the <tt>ucredit</tt> setting in
    <tt>/etc/security/pwquality.conf</tt> to require the use of an uppercase character in passwords.

rationale: |-
    Use of a complex password helps to increase the time and resources reuiqred to compromise the password.
    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts
    at guessing and brute-force attacks.
    <br /><br />
    Password complexity is one factor of several that determines how long it takes to crack a password. The more
    complex the password, the greater the number of possible combinations that need to be tested before
    the password is compromised.

severity: medium

identifiers:
    cce@rhel7: 27200-5

references:
    cis: 6.3.2
    disa: 192
    nist: IA-5(b),IA-5(c),IA-5(1)(a)
    ospp@rhel7: FMT_MOF_EXT.1
    pcidss: Req-8.2.3
    srg: SRG-OS-000069-GPOS-00037
    stigid@rhel7: "010120"

ocil_clause: 'ucredit is not found or not set less than or equal to the required value'

ocil: |-
    To check how many uppercase characters are required in a password, run the following command:
    <pre>$ grep ucredit /etc/security/pwquality.conf</pre>
    The <tt>ucredit</tt> parameter (as a negative number) will indicate how many uppercase characters are required.
    The DoD and FISMA require at least one uppercase character in a password.
    This would appear as <tt>ucredit = -1</tt>.
