Ensure password length is configured

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Run the following command to verify that the password length is 14 or more characters and conforms to local site policy: # grep -Ei -- '\bminlen=.*(1[4-9]|[2-9][0-9]|[1-9][0-9]{2,})\b' /etc/pam.d/* Example output: /etc/pam.d/passwd:password requisite pam_passwdqc.so enforce=everyone minlen=disabled,14,12,8,6 Verify returned value(s) are no less than 14 characters for N1 and meet local site policy Run the following command to verify that minlen is not set, or is 14 or more characters, and conforms to local site policy: grep -Ei -- ... (full steps: CIS section 4.4.1.1.1)

How it is fixed

Fix method: Guidance or infrastructure patch

Create or modify the file /etc/pam.d/passwd and add or modify the following line to set the password length of 14 or more characters. Ensure that password length conforms to local site policy: Example: password requisite pam_passwdqc.so enforce=everyone minlen=disabled,14,12,8,6