Password length restrictions (UNIX)

Module: Password Strength

This check examines the system configuration for the minimum password length that the passwd program will accept. The check reports a problem if the minimum length is less than the length specified in your policy. This check runs only on UNIX operating systems that support minimum password length restrictions. This currently includes AIX, Solaris, Digital UNIX/Tru64, Red Hat Linux, SuSE Linux and HP-UX 11+ systems. When password length specified in configuration file and in policy is more than maximum length supported by algorithm used to encrypt the password then both the length specified in policy and in configuration file are made equal to password length supported by algorithm.

The following table lists the error message for the check.

Table: Error message for Password length restrictions

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: STKU_MINPASSLEN

Category: ESM Error

UNIX (5334)

Title: Minimum password length too short

Description:Your system has a minimum password length restriction that is less than the value specified by your policy. The default value is six characters. Short passwords expose your system to intruders because they are easy to guess. You should set the minimum password length to at least six characters.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]