Rule ID
SV-286233r1291993_rule
Version
V1R1
CCIs
Password-based authentication applies to passwords regardless of whether they are used in single-factor or multifactor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.
Verify a password validation plugin that supports detection of commonly used or compromised passwords is installed and active: SHOW PLUGINS; Verify "cracklib_password_check" or an organization-approved equivalent plugin is listed with Status = ACTIVE. If no password validation plugin capable of checking commonly used or compromised passwords is installed and active, this is a finding. Verify the password validation plugin is configured to use a dictionary file: SHOW VARIABLES LIKE 'cracklib_password_check_dictionary'; If no dictionary file is configured, this is a finding. Verify the configured dictionary file exists on the system: ls -l <dictionary_path> If the dictionary file does not exist, this is a finding. Verify the dictionary file is maintained and updated in accordance with organization-defined frequency. If the dictionary file is not updated per organizational policy, this is a finding. Verify password validation is enforced by attempting to create a user with a commonly used password: CREATE USER 'test_user'@'localhost' IDENTIFIED BY 'password'; If the system allows creation of a user with a commonly used or compromised password, this is a finding. Verify password validation configuration aligns with organizational policy: SHOW VARIABLES LIKE 'cracklib_password_check%'; If password validation settings are not configured in accordance with organization-defined requirements, this is a finding.
Configure MariaDB to prevent the use of commonly used, expected, or compromised passwords by implementing the Cracklib Password Check plugin. Install the Cracklib password check plugin: INSTALL SONAME 'cracklib_password_check'; Depending on the operating system, the Cracklib package may need to be installed prior to enabling the plugin (for example, "mariadb-plugin-cracklib-password-check"). Configure the plugin. Specify a dictionary. The Cracklib Password Check plugin validates passwords against a dictionary. A systemwide dictionary or a custom dictionary can be used. Set the dictionary path using the "cracklib_password_check_dictionary" variable to define the dictionary file location. Additional password validation mechanisms may also be implemented. Simple Password Check: Enforces minimum password length and character type requirements such as digits, letters, and special characters. Password Reuse Check: Prevents users from reusing previously used passwords. Password policies should also include the following controls: - Implement password expiration policies (for example requiring users to change passwords every 90 days). - Set minimum password length and complexity requirements including uppercase letters, lowercase letters, numbers, and special characters. - Implement account lockout mechanisms after a defined number of failed login attempts to reduce the risk of brute force attacks.