← Back to Red Hat Enterprise Linux 10 Security Technical Implementation Guide

V-281215

CAT II (Medium)

RHEL 10 must ensure the password complexity module is enabled in the "system-auth" file.

Rule ID

SV-281215r1166597_rule

STIG

Red Hat Enterprise Linux 10 Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-004066

Discussion

Enabling Pluggable Authentication Module (PAM) password complexity permits enforcement of strong passwords and consequently makes the system less prone to dictionary attacks.

Check Content

Verify RHEL 10 uses "pwquality" to enforce the password complexity rules in the "system-auth" file with the following command:

$ sudo grep pam_pwquality /etc/pam.d/system-auth
password required pam_pwquality.so

If the command does not return a line containing the value "pam_pwquality.so", or the line is commented out, this is a finding.

If the system administrator can demonstrate that the required configuration is contained in a PAM configuration file included or substacked from the "system-auth" file, this is not a finding.

Fix Text

Configure RHEL 10 to use "pwquality" to enforce password complexity rules.

Add the following line to the "/etc/pam.d/system-auth" file (or modify the line to have the required value):

password required pam_pwquality.so