Check: OL6-00-000060
Oracle Linux 6 STIG:
OL6-00-000060
(in versions v2 r7 through v1 r13)
Title
The system must require at least eight characters be changed between the old and new passwords during a password change. (Cat III impact)
Discussion
Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note: Passwords which are changed on compromised systems will still be compromised.
Check Content
To check how many characters must differ during a password change, run the following command: $ grep pam_cracklib /etc/pam.d/system-auth /etc/pam.d/password-auth The "difok" parameter will indicate how many characters must differ. The DoD requires eight characters differ during a password change. This would appear as "difok=8". If the “difok” parameter is not found or not set to the required value, this is a finding.
Fix Text
The pam_cracklib module's "difok" parameter controls requirements for usage of different characters during a password change. Edit /etc/pam.d/system-auth and /etc/pam.d/password-auth adding "difok=[NUM]" after pam_cracklib.so to require differing characters when changing passwords, substituting [NUM] appropriately. The DoD requirement is “8”.
Additional Identifiers
Rule ID: SV-208835r793620_rule
Vulnerability ID: V-208835
Group Title: SRG-OS-000072
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000195 |
The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed. |
Controls
Number | Title |
---|---|
IA-5 (1) |
Password-Based Authentication |