V-285666

Discussion

Weak password composition requirements, inadequate password lifetime controls, insufficient password hashing protections, and ineffective authentication safeguards increase the likelihood of credential compromise. Enforcing password complexity requirements, password aging controls, cryptographic password storage settings, and authentication delay mechanisms strengthens the protection of authenticators and reduces the risk of unauthorized access to Harvester Government resources. Satisfies: SRG-OS-000069-GPOS-00037, SRG-OS-000070-GPOS-00038, SRG-OS-000071-GPOS-00039, SRG-OS-000078-GPOS-00046, SRG-OS-000266-GPOS-00101, SRG-OS-000725-GPOS-00180

Check Content

Verify Harvester Government enforces password complexity and account authentication policy requirements.

1. Access Harvester Government using a privileged account and review the password complexity configuration:

grep "pam_cracklib.so" /etc/pam.d/common-password

2. Verify the "pam_cracklib.so" configuration includes the following parameters:

ucredit=-1
lcredit=-1
dcredit=-1
ocredit=-1
dictcheck=1
difok=8
minlen=15

The parameters enforce:
- Passwords require at least one uppercase character.
- Passwords require at least one lowercase character.
- Passwords require at least one numeric character.
- Passwords require at least one special character.
- Dictionary word checking is enabled.
- New passwords differ from previous passwords by at least eight characters.
- Passwords require a minimum length of 15 characters.

Example compliant output:

password requisite pam_cracklib.so retry=3 minlen=15 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 dictcheck=1 difok=8

If "pam_cracklib.so" is absent, any required parameter is missing, commented out, or configured with values other than the approved baseline, this is a finding.

3. In the login.defs configuration file, verify account authentication policy settings are configured:

grep -E "^(SHA_CRYPT_MIN_ROUNDS|SHA_CRYPT_MAX_ROUNDS|PASS_MIN_DAYS|PASS_MAX_DAYS|FAIL_DELAY)" /etc/login.defs

4. Verify the output includes:

SHA_CRYPT_MIN_ROUNDS 5000
SHA_CRYPT_MAX_ROUNDS 5000
PASS_MIN_DAYS 1
PASS_MAX_DAYS 60
FAIL_DELAY 4

The parameters enforce:
- Password hashing rounds are explicitly configured.
- Passwords cannot be changed more frequently than one day.
- Passwords expire after 60 days.
- Authentication failures enforce a four-second delay.

If any required parameter is absent, commented out, or configured with values other than the approved baseline, this is a finding.