UCF STIG Viewer Logo

The system must require passwords to contain a minimum of 15 characters.


Finding ID Version Rule ID IA Controls Severity
V-217887 RHEL-06-000050 SV-217887r505923_rule Medium
Requiring a minimum password length makes password cracking attacks more difficult by ensuring a larger search space. However, any security benefit from an onerous requirement must be carefully weighed against usability problems, support costs, or counterproductive behavior that may result. While it does not negate the password length requirement, it is preferable to migrate from a password-based authentication scheme to a stronger one based on PKI (public key infrastructure).
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2020-09-03


Check Text ( C-19368r462370_chk )
To check the minimum password length, run the command:

$ grep PASS_MIN_LEN /etc/login.defs

The DoD requirement is "15".

If it is not set to the required value, this is a finding.

$ grep –E ‘pam_cracklib.so.*minlen’ /etc/pam.d/*

If no results are returned, this is not a finding.

If any results are returned and are not set to “15” or greater, this is a finding.
Fix Text (F-19366r462371_fix)
To specify password length requirements for new accounts, edit the file "/etc/login.defs" and add or correct the following lines:


The DoD requirement is "15". If a program consults "/etc/login.defs" and also another PAM module (such as "pam_cracklib") during a password change operation, then the most restrictive must be satisfied.