Check: GEN000750
AIX 5.3 STIG:
GEN000750
(in version v1 r3)
Title
The system must require at least four characters be changed between the old and new passwords during a password change. (Cat II impact)
Discussion
To ensure password changes are effective in their goals, the system must ensure old and new passwords have significant differences. Without significant changes, new passwords may be easily guessed based on the value of a previously compromised password.
Check Content
Check the value of the mindiff parameter. Procedure: #lsuser -a mindiff ALL If any users mindiff is less than 4, this is a finding.
Fix Text
Use the chsec command to change mindiff to 4. # chsec -f /etc/security/user -s default -a mindiff=4 # chuser mindiff=4 < user id >
Additional Identifiers
Rule ID: SV-38677r1_rule
Vulnerability ID: V-22306
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000195 |
The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed. |
Controls
Number | Title |
---|---|
IA-5 (1) |
Password-Based Authentication |