CME-802

Password Quality Enforcement (pwquality)

Harden Identity Unquantified evidence Preventive

Description

Enforce minimum password complexity requirements via pam_pwquality (Linux) or Group Policy (Windows), ensuring user-chosen passwords resist brute force and dictionary attacks. Key enforcement parameters: minimum length (minlen, typically 14+), minimum character classes (minclass, requiring uppercase, lowercase, digits, and symbols), and dictionary checking (rejecting common words and variations). The combined effect is a search space of ~95^14 (~4.9x10^27) for online attacks, making brute force impractical within lockout windows. On RHEL/Fedora, pam_pwquality is the standard PAM module; on Debian/Ubuntu, it is available as libpam-pwquality. Windows enforces equivalent policy via Group Policy (Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy) or Fine-Grained Password Policies in Active Directory.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	Without quality enforcement, users choose weak passwords (common words, short strings, credential-stuffing targets) that can be guessed via dictionary attack or brute force with minimal effort. With minlen=14 and minclass=4 enforced, the password search space grows to ~95^14 combinations, making online brute force impractical and offline cracking require significant resources even with GPU acceleration — the attacker must find an alternative authentication bypass rather than simply guessing the password

CWE Relationships

CWE-521

Verification

Verify password quality enforcement via pwquality.conf (Linux) or Group Policy (Windows)

$ grep '^minlen' /etc/security/pwquality.conf | grep -oE '[0-9]+'
# Expected: >=14

Platform: linux

$ grep '^minclass' /etc/security/pwquality.conf | grep -oE '[0-9]+'
# Expected: >=3

Platform: linux

$ grep -c 'pam_pwquality.so' /etc/pam.d/system-auth /etc/pam.d/common-password 2>/dev/null
# Expected: >=1

Platform: linux

$ net accounts | Select-String 'Minimum password length'
# Expected: Minimum password length 14

Platform: windows

Remediation

linux pam_pwquality configuration with minlen=14 and minclass=4


sed -i 's/^#\?\s*minlen\s*=.*/minlen = 14/' /etc/security/pwquality.conf && sed -i 's/^#\?\s*minclass\s*=.*/minclass = 4/' /etc/security/pwquality.conf && sed -i 's/^#\?\s*dictcheck\s*=.*/dictcheck = 1/' /etc/security/pwquality.conf
grep -q 'pam_pwquality.so' /etc/pam.d/system-auth 2>/dev/null || grep -q 'pam_pwquality.so' /etc/pam.d/common-password 2>/dev/null || echo 'password requisite pam_pwquality.so retry=3 enforce_for_root' >> /etc/pam.d/system-auth

windows Windows local password policy via net accounts


net accounts /minpwlen:14
secedit /export /cfg C:\Windows\Temp\secpol.cfg && (Get-Content C:\Windows\Temp\secpol.cfg) -replace 'PasswordComplexity\s*=\s*0','PasswordComplexity = 1' | Set-Content C:\Windows\Temp\secpol.cfg && secedit /configure /db C:\Windows\Security\local.sdb /cfg C:\Windows\Temp\secpol.cfg /areas SECURITYPOLICY
net accounts /minpwage:1

Applicability (CVE 5.2.0 Schema)

Vendor	Product	CPEs	Platforms	Status
redhat	enterprise_linux	`cpe:2.3:o:redhat:enterprise_linux:8:::::::` `cpe:2.3:o:redhat:enterprise_linux:9:::::::` `cpe:2.3:o:redhat:enterprise_linux:10:::::::*`	All	applicable
microsoft	windows	`cpe:2.3:o:microsoft:windows_10::::::::` `cpe:2.3:o:microsoft:windows_11::::::::` `cpe:2.3:o:microsoft:windows_server_2019:::::::` `cpe:2.3:o:microsoft:windows_server_2022:::::::`	All	applicable

Password Quality Enforcement (pwquality)

Description

CVSS Vector Impacts

CWE Relationships

Verification

Remediation

Applicability (CVE 5.2.0 Schema)

References