Check: GEN000750
AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE:
GEN000750
(in versions v1 r14 through v1 r10)
Title
The system must require at least eight characters be changed between the old and new passwords during a password change. (Cat II impact)
Discussion
To ensure password changes are effective in their goals, the system must ensure old and new passwords have significant differences. Without significant changes, new passwords may be easily guessed based on the value of a previously compromised password.
Check Content
Check the value of the mindiff parameter. Procedure: #lsuser -a mindiff ALL If any user's mindiff is less than 8, this is a finding.
Fix Text
Use the chsec command to change mindiff to 8. # chsec -f /etc/security/user -s default -a mindiff=8 # chuser mindiff=8 < user id >
Additional Identifiers
Rule ID: SV-38677r2_rule
Vulnerability ID: V-22306
Group Title: GEN000750
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000195 |
The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed. |
Controls
Number | Title |
---|---|
IA-5 (1) |
Password-Based Authentication |