The Photon operating system must enforce password complexity on the root account.

Password complexity rules must apply to all accounts on the system, including root. Without specifying the enforce_for_root flag, pam_pwquality does not apply complexity rules to the root user. While root users can find ways around this requirement, given its superuser power, it is necessary to attempt to force compliance.

At the command line, run the following command to verify password complexity is enforced for the root account:

# grep '^password.*pam_pwquality.so' /etc/pam.d/system-password

Example result:

password requisite pam_pwquality.so dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 minlen=15 difok=8 enforce_for_root dictcheck=1

If the "enforce_for_root" option is missing or commented out, this is a finding.

Navigate to and open:

/etc/pam.d/system-password

Configure the pam_pwquality.so line to have the "enforce_for_root" option present as follows:

password requisite pam_pwquality.so dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 minlen=15 difok=8 enforce_for_root dictcheck=1

Note: On vCenter appliances, the equivalent file must be edited under "/etc/applmgmt/appliance", if one exists, for the changes to persist after a reboot.