MISSION BRIEFINGA credential stuffing attack succeeded because users had weak passwords with no expiration policy. Implement password complexity via PAM, configure aging policies, and set up account lockout to prevent brute-force.
Password Commands
cat /etc/shadow
View password hashes and aging
chage -l username
List password aging info
chage -M 90 username
Set max password age (90 days)
chage -m 7 username
Set min password age (7 days)
cat /etc/security/pwquality.conf
View password quality rules
cat /etc/pam.d/common-auth
View PAM auth config
passwd -e username
Expire password (force change)
Why This Matters
NIST SP 800-63B-4 recommends minimum 8-character passwords plus breach-list checking, and explicitly directs verifiers SHOULD NOT impose composition (mixed-character) rules or schedule-based rotation. Account lockout (rate limiting) is recommended. PCI DSS Requirement 8 mandates password policies. Without them, credential stuffing and brute-force attacks succeed trivially.
