Check: SOL-11.1-040060
Solaris 11 X86 STIG:
SOL-11.1-040060
(in versions v3 r2 through v3 r1)
Title
The system must require at least eight characters be changed between the old and new passwords during a password change. (Cat II impact)
Discussion
To ensure password changes are effective in their goals, the system must ensure old and new passwords have significant differences. Without significant changes, new passwords may be easily guessed based on the value of a previously compromised password.
Check Content
Check /etc/default/passwd to verify the MINDIFF setting. # grep ^MINDIFF /etc/default/passwd If the setting is not present, or is less than eight, this is a finding.
Fix Text
The root role is required. # pfedit /etc/default/passwd Search for MINDIFF. Change the line to read: MINDIFF=8
Additional Identifiers
Rule ID: SV-216091r1016286_rule
Vulnerability ID: V-216091
Group Title: SRG-OS-000072
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000195 |
The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed. |
| CCI-004066 |
For password-based authentication, enforce organization-defined composition and complexity rules. |
Controls
| Number | Title |
|---|---|
| IA-5(1) |
Password-based Authentication |