password length with pam_cracklib.so

Question

I ran a security scan in a RedHat Linux Server and got the following vulnerabilty:

Incorrect System Default minimum password length or password complexity rules. Minimum password length should be set to 8. It should be set through pam_cracklib.so or pam_pwquality.so or pam_passwdqc.so.

in the /etc/pam.d/system-auth I set the following line:

password    requisite     pam_cracklib.so try_first_pass retry=5  minlength=8 

but somehow I am still getting the same vulnerability. I don’t know which parameter am I missing in the file.

Answer 1

The man page for pam_cracklib lists the options the module accepts. Among them is what you're probably looking for:

minlen=N
The minimum acceptable size for the new password

Note the abbreviated spelling, it's minlen, not minlength. The module might or might not log an error message for minlength if it doesn't recognize it. (One might be tempted to say that the module should fail if it's given an unknown option.)

Note that minlength isn't exact, pam_cracklib gives so called "credit" for the password having e.g. upper case letters and digits. Check the documentation for ucredit, lcredit, ocredit and dcredit carefully.

Also, it's probably a good idea to test the actual behaviour after configuring stuff like that.