Cis Ubuntu2004 V300 5 3 3 2 6

5.3.3.2.6 Ensure password dictionary check is enabled (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

The pwquality dictcheck option sets whether to check for the words from the cracklib dictionary.

Rationale

If the operating system allows the user to select passwords based on dictionary words, this increases the chances of password compromise by increasing the opportunity for successful guesses, and brute-force attacks.

Audit Procedure

Command Line

Run the following command to verify that the dictcheck option is not set to 0 (disabled) in a pwquality configuration file:

# grep -Psi -- '^\h*dictcheck\h*=\h*0\b' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf

Nothing should be returned.

Run the following command to verify that the dictcheck option is not set to 0 (disabled) as a module argument in a PAM file:

# grep -Psi -- '^\h*password\h+(requisite|required|sufficient)\h+pam_pwquality\.so\h+([^#\n\r]+\h+)?dictcheck\h*=\h*0\b' /etc/pam.d/common-password

Nothing should be returned.

Note:

• Settings observe an order of precedence:
  • module arguments override the settings in the /etc/security/pwquality.conf configuration file
  • settings in the /etc/security/pwquality.conf configuration file override settings in a .conf file in the /etc/security/pwquality.conf.d/ directory
  • settings in a .conf file in the /etc/security/pwquality.conf.d/ directory are read in canonical order, with last read file containing the setting taking precedence
• It is recommended that settings be configured in a .conf file in the /etc/security/pwquality.conf.d/ directory for clarity, convenience, and durability.

Remediation

Command Line

Edit any file ending in .conf in the /etc/security/pwquality.conf.d/ directory and/or the file /etc/security/pwquality.conf and comment out or remove any instance of dictcheck = 0:

Example:

# sed -ri 's/^\s*dictcheck\s*=/#  &/' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf

Run the following command:

# grep -Pl -- '\bpam_pwquality\.so\h+([^#\n\r]+\h+)?dictcheck\b' /usr/share/pam-configs/*

Edit any returned files and remove the dictcheck argument from the pam_pwquality.so line(s).

Default Value

dictcheck = 1

References

1. NIST SP 800-53 Rev. 5: IA-5

CIS Controls

MITRE ATT&CK Mappings