Title

Newly created password content must be checked. (Cat II impact)

Discussion

Configure the local system to verify newly created passwords do not contain user's account name or parts of the user's full name exceeding two consecutive characters.

Check Content

Open a terminal session and use the following command to view the setting for "password cannot be name". sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep passwordCannotBeName If the value of "passwordCannotBeName" is not equal to "1", this is a finding. NOTE: If the command returns a response of "password server is not configured", the system is not managed. Use the following command for non-managed systems. pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep passwordCannotBeName If the value of "passwordCannotBeName" is not equal to "1", this is a finding.

Fix Text

Open a terminal session and use the following command to set the value for "password cannot be name". sudo pwpolicy -n -setglobalpolicy "passwordCannotBeName=1" NOTE: For non-managed system, use the following command. pwpolicy -n /Local/Default -setglobalpolicy "passwordCannotBeName=1"

Additional Identifiers

Rule ID: SV-37177r1_rule

Vulnerability ID: V-25238

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.