Ensure PAM Enforces Password Requirements - Minimum Length

Classification:

compliance

Framework:

Control:

Description

The pam_pwquality module’s minlen parameter controls requirements for minimum characters required in a password. Add minlen=14 after pam_pwquality to set minimum password length requirements.

Rationale

The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.

Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'libpam-runtime' 2>/dev/null | grep -q installed; then

var\_password\_pam\_minlen='14'






# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped\_key=$(sed 's/[\^=\$,;+]\*//g' <<< "^minlen")

# shellcheck disable=SC2059
printf -v formatted\_output "%s = %s" "$stripped\_key" "$var\_password\_pam\_minlen"

# If the key exists, change it. Otherwise, add it to the config\_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC\_ALL=C grep -q -m 1 -i -e "^minlen\\>" "/etc/security/pwquality.conf"; then
 escaped\_formatted\_output=$(sed -e 's|/|\\/|g' <<< "$formatted\_output")
 LC\_ALL=C sed -i --follow-symlinks "s/^minlen\\>.\*/$escaped\_formatted\_output/gi" "/etc/security/pwquality.conf"
else
 if [[ -s "/etc/security/pwquality.conf" ]] && [[ -n "$(tail -c 1 -- "/etc/security/pwquality.conf" || true)" ]]; then
 LC\_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/security/pwquality.conf"
 fi
 printf '%s\n' "$formatted\_output" >> "/etc/security/pwquality.conf"
fi

else
 >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Gather the package facts
 package\_facts:
 manager: auto
 tags:
 - CJIS-5.6.2.1.1
 - DISA-STIG-UBTU-20-010054
 - NIST-800-53-CM-6(a)
 - NIST-800-53-IA-5(1)(a)
 - NIST-800-53-IA-5(4)
 - NIST-800-53-IA-5(c)
 - PCI-DSS-Req-8.2.3
 - PCI-DSSv4-8.3.6
 - PCI-DSSv4-8.3.9
 - accounts\_password\_pam\_minlen
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed
 - restrict\_strategy
- name: XCCDF Value var\_password\_pam\_minlen # promote to variable
 set\_fact:
 var\_password\_pam\_minlen: !!str 14
 tags:
 - always

- name: Ensure PAM Enforces Password Requirements - Minimum Length - Ensure PAM variable
 minlen is set accordingly
 ansible.builtin.lineinfile:
 create: true
 dest: /etc/security/pwquality.conf
 regexp: ^#?\s\*minlen
 line: minlen = {{ var\_password\_pam\_minlen }}
 when: '"libpam-runtime" in ansible\_facts.packages'
 tags:
 - CJIS-5.6.2.1.1
 - DISA-STIG-UBTU-20-010054
 - NIST-800-53-CM-6(a)
 - NIST-800-53-IA-5(1)(a)
 - NIST-800-53-IA-5(4)
 - NIST-800-53-IA-5(c)
 - PCI-DSS-Req-8.2.3
 - PCI-DSSv4-8.3.6
 - PCI-DSSv4-8.3.9
 - accounts\_password\_pam\_minlen
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed
 - restrict\_strategy