Check: GEN000800
HP-UX 11.31 STIG:
GEN000800
(in versions v1 r19 through v1 r13)
Title
The system must prohibit the reuse of passwords within five iterations. (Cat II impact)
Discussion
If a user, or root, used the same password continuously or was allowed to change it back shortly after being forced to change it, this would provide a potential intruder with the opportunity to keep guessing at one user's password until it was guessed correctly.
Check Content
For Trusted Mode: Check the PASSWORD_HISTORY_DEPTH setting. # cat /etc/default/security | grep PASSWORD_HISTORY_DEPTH If PASSWORD_HISTORY_DEPTH is not set to 5 or greater, this is a finding. For SMSE: Check the PASSWORD_HISTORY_DEPTH setting. # grep PASSWORD_HISTORY_DEPTH /etc/default/security /var/adm/userdb/* If PASSWORD_HISTORY_DEPTH is not set to 5 or greater, this is a finding.
Fix Text
For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_HISTORY_DEPTH attribute. See the below example: PASSWORD_HISTORY_DEPTH=5 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_HISTORY_DEPTH attribute. See the below example: PASSWORD_HISTORY_DEPTH=5 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.
Additional Identifiers
Rule ID: SV-38417r2_rule
Vulnerability ID: V-4084
Group Title: GEN000800
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000200 |
The information system prohibits password reuse for the organization-defined number of generations. |
Controls
Number | Title |
---|---|
IA-5 (1) |
Password-Based Authentication |