documentation_complete: true

prodtype: rhel7,fedora

title: 'Set Password Strength Minimum Different Categories'

description: "The pam_pwquality module's <tt>minclass</tt> parameter controls\nrequirements for usage of different character classes, or types, of character\nthat must exist in a password before it is considered valid. For example,\nsetting this value to three (3) requires that any password must have characters\nfrom at least three different categories in order to be approved. The default\nvalue is zero (0), meaning there are no required classes. There are four\ncategories available:\n<pre>\n* Upper-case characters\n* Lower-case characters\n* Digits\n* Special characters (for example, punctuation)\n</pre>\nModify the <tt>minclass</tt> setting in <tt>/etc/security/pwquality.conf</tt> entry to require <sub idref=\"var_password_pam_minclass\" /> \ndiffering categories of characters when changing passwords."

rationale: "Use of a complex password helps to increase the time and resources required to compromise the password.\nPassword complexity, or strength, is a measure of the effectiveness of a password in resisting attempts \nat guessing and brute-force attacks.\n<br /><br />\nPassword complexity is one factor of several that determines how long it takes to crack a password. The\nmore complex the password, the greater the number of possible combinations that need to be tested before\nthe password is compromised.\n<br /><br />\nRequiring a minimum number of character categories makes password guessing attacks more difficult \nby ensuring a larger search space."

severity: medium

identifiers:
    cce@rhel7: CCE-27115-5

references:
    disa: 195
    nist: IA-5
    srg: SRG-OS-000072-GPOS-00040
    stigid@rhel7: "010170"

ocil_clause: 'minclass is not found or not set equal to or greater than the required value'

ocil: |-
    To check how many categories of characters must be used in password during a password change,
    run the following command:
    <pre>$ grep minclass /etc/security/pwquality.conf</pre>
    The <tt>minclass</tt> parameter will indicate how many character classes must be used. If
    the requirement was for the password to contain characters from three different categories,
    then this would appear as <tt>minclass = 3</tt>.
