Check Details

• Resource: Server
• Check: Ensure password creation requirements are configured
• Risk: Weak or improperly configured password policies increase the risk of brute-force and unauthorized access attacks.

Remediation Steps

1. Open a terminal session on the server with root or sudo privileges.

2. Verify the current password policy configuration:

   

   cat /etc/security/passwdqc.conf
   

3. Ensure the configuration includes secure password requirements similar to the following:

   

   min=disabled,disabled,disabled,disabled,14
   max=40
   passphrase=3
   match=4
   similar=deny
   random=47
   enforce=everyone
   retry=3
   

4. Open the configuration file for editing:

   

   sudo nano /etc/security/passwdqc.conf
   

5. Update or add the required parameters based on your organization's password policy.

6. Verify that the pam_passwdqc module is enabled in PAM configuration:

   

   grep pam_passwdqc.so /etc/pam.d/system-auth
   

7. Ensure the following line exists:

   

   password required pam_passwdqc.so config=/etc/security/passwdqc.conf
   

8. Save the changes and exit the editor.
9. Test password changes to ensure the new policy is enforced correctly.
10. Perform regular audits to ensure password policies remain compliant with organizational security standards.