Navigate

Check: SOL-11.1-040060

Solaris 11 x86 STIG: SOL-11.1-040060 (in versions v2 r10 through v1 r10)

Title

The system must require at least eight characters be changed between the old and new passwords during a password change. (Cat II impact)

Discussion

To ensure password changes are effective in their goals, the system must ensure old and new passwords have significant differences. Without significant changes, new passwords may be easily guessed based on the value of a previously compromised password.

Check Content

Check /etc/default/passwd to verify the MINDIFF setting. # grep ^MINDIFF /etc/default/passwd If the setting is not present, or is less than 8, this is a finding.

Fix Text

The root role is required. # pfedit /etc/default/passwd Search for MINDIFF. Change the line to read: MINDIFF=8

Additional Identifiers

Rule ID: SV-216091r603268_rule

Vulnerability ID: V-216091

Group Title: SRG-OS-000072

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-000195	The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
IA-5 (1)	Password-Based Authentication