← Back to Nutanix AOS 5.20.x OS Security Technical Implementation Guide

V-254192

CAT II (Medium)

Nutanix AOS must prevent the use of dictionary words for passwords.

Rule ID

SV-254192r991587_rule

STIG

Nutanix AOS 5.20.x OS Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-000366

Discussion

If the operating system allows the user to select passwords based on dictionary words, then this increases the chances of password compromise by increasing the opportunity for successful guesses and brute-force attacks.

Check Content

Confirm Nutanix AOS prevents the use of dictionary words for passwords. 

Check the /etc/pam.d/password-auth file for pam_pwquality.so

$ sudo grep pwquality.so /etc/pam.d/password-auth
password    requisite     pam_pwquality.so try_first_pass local_users_only enforce_for_root retry=3 authtok_type=
 
If the output does not contain "pam_pwquality.so" with the option of "required" or "requisite", this is a finding.

Fix Text

Configure Nutanix AOS to enforce the use of pam_pwquality.so by running the following command.

$ sudo salt-call state.sls security/CVM/pamCVM