The system must prevent the use of dictionary words for passwords.

From AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE

Associated with IA controls: IAIA-2, IAIA-1

Associated with: CCI-000189

SV-38678r1_rule The system must prevent the use of dictionary words for passwords.

Vulnerability discussion

An easily guessable password provides an open door to any external or internal malicious intruder. Many computer compromises occur as the result of account name and password guessing. This is generally done by someone with an automated script using repeated logon attempts until the correct account and password pair is guessed. Utilities, such as cracklib, can be used to validate that passwords are not dictionary words and meet other criteria during password changes.

Check content

Procedure: #lsuser -a dictionlist ALL If the dictionlist is blank or not listed, the system is not checking against a dictionary of words that are not to be used for passwords. This is a finding.

Fix text

Install the default dictionary of words from the 'bos.data' fileset with smitty or installp. # smitty installp #installp bos.data Customize or modify the dictionary in /usr/share/dict/words as necessary. #vi /usr/share/dict/words Add a dictionary list to /etc/security/user file with the chsec command. #chsec -f /etc/security/user -s default -a dictionlist=/usr/share/dict/words

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.