Title

The system must prohibit the reuse of passwords within five iterations. (Cat II impact)

Discussion

If a user, or root, used the same password continuously or was allowed to change it back shortly after being forced to change it to something else, it would provide a potential intruder with the opportunity to keep guessing at one user's password until it was guessed correctly.

Check Content

Check the HISTORY setting. # grep HISTORY /etc/default/passwd If HISTORY is not set to 5 or more, this is a finding.

Fix Text

Edit /etc/default/passwd and set HISTORY to 5.

Additional Identifiers

Rule ID:

Vulnerability ID: V-4084

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.