>From f43c5ca2c8295879886455f9d42dbbb64fb4bd73 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Thu, 25 Apr 2013 20:00:11 -0400 Subject: [PATCH 41/64] Added IA-5(1) mappings - 12char passwords - 1x upper, lower, special, # --- RHEL6/input/system/accounts/pam.xml | 14 +++++++------- .../accounts/restrictions/password_expiration.xml | 3 ++- .../accounts/restrictions/password_storage.xml | 2 +- 3 files changed, 10 insertions(+), 9 deletions(-) diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index dd460c9..29d5c5c 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -303,7 +303,7 @@ Add ucredit=-1 after pam_cracklib.so to require use of an upper case ch To check how many uppercase characters are required in a password, run the following command:
$ grep pam_cracklib /etc/pam.d/system-auth
The ucredit parameter (as a negative number) will indicate how many uppercase characters are required. -The DoD requires at least one uppercase character in a password. +The DoD and FISMA require at least one uppercase character in a password. This would appear as ucredit=-1. @@ -312,7 +312,7 @@ more difficult by ensuring a larger search space. - + @@ -328,7 +328,7 @@ Add ocredit=-1 after pam_cracklib.so to require use of a special charac To check how many special characters are required in a password, run the following command:
$ grep pam_cracklib /etc/pam.d/system-auth
The ocredit parameter (as a negative number) will indicate how many special characters are required. -The DoD requires at least one special character in a password. +The DoD and FISMA require at least one special character in a password. This would appear as ocredit=-1. @@ -337,7 +337,7 @@ more difficult by ensuring a larger search space. - + @@ -353,7 +353,7 @@ Add lcredit=-1 after pam_cracklib.so to require use of a lowercase char To check how many lowercase characters are required in a password, run the following command:
$ grep pam_cracklib /etc/pam.d/system-auth
The lcredit parameter (as a negative number) will indicate how many special characters are required. -The DoD requires at least one lowercase character in a password. +The DoD and FISMA require at least one lowercase character in a password. This would appear as lcredit=-1. @@ -362,7 +362,7 @@ more difficult by ensuring a larger search space. - + @@ -372,7 +372,7 @@ more difficult by ensuring a larger search space. usage of different characters during a password change. Add difok=NUM after pam_cracklib.so to require differing characters when changing passwords, substituting NUM appropriately. -The DoD requirement is 4. +The DoD requirement is 4. To check how many characters must differ during a password change, run the following command: diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml index 910c5e8..5b45aa1 100644 --- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml +++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml @@ -84,6 +84,7 @@ lines:
PASS_MIN_LEN 14


The DoD requirement is 14. +The FISMA requirement is 12. If a program consults /etc/login.defs and also another PAM module (such as pam_cracklib) during a password change operation, then the most restrictive must be satisfied. See PAM section @@ -103,7 +104,7 @@ behavior that may result. - + diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml index 0df7f2c..efa8d0d 100644 --- a/RHEL6/input/system/accounts/restrictions/password_storage.xml +++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml @@ -38,7 +38,7 @@ environments. - + -- 1.7.1