Title

The system must require passwords to contain no more than three consecutive repeating characters. (Cat III impact)

Discussion

Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks.

Check Content

To check the maximum value for consecutive repeating characters, run the following command: $ grep pam_cracklib /etc/pam.d/system-auth /etc/pam.d/password-auth Look for the value of the "maxrepeat" parameter. If "maxrepeat" is not found, is set to zero, or is set to a value greater than "3", this is a finding.

Fix Text

The pam_cracklib module's "maxrepeat" parameter controls requirements for consecutive repeating characters. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters. Edit /etc/pam.d/system-auth and /etc/pam.d/password-auth adding "maxrepeat=3" after pam_cracklib.so to prevent a run of (3 + 1) or more identical characters. password required pam_cracklib.so maxrepeat=3

Additional Identifiers

Rule ID: SV-218047r603264_rule

Vulnerability ID: V-218047

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.