Navigate

Check: GEN000750

IRIX 6.5: GEN000750 (in versions v1 r1 through v1 r0.6)

Title

The system must require at least eight characters be changed between the old and new passwords during a password change. (Cat II impact)

Discussion

To ensure password changes are effective in their goals, the system must ensure old and new passwords have significant differences. Without significant changes, new passwords may be easily guessed based on the value of a previously compromised password.

Check Content

Check /etc/default/passwd to verify the MINDIFF setting. # grep MINDIFF /etc/default/passwd If the setting is not present, or is less than 8, this is a finding.

Fix Text

Edit /etc/default/passwd and set or add a MINDIFF setting equal to or greater than 8.

Additional Identifiers

Rule ID:

Vulnerability ID: V-22306

Group Title:

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-000195	The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
IA-5 (1)	Password-Based Authentication