Title

Users must not reuse the last 5 passwords. (Cat II impact)

Discussion

Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute-force attacks. To meet password policy requirements, passwords need to be changed at specific policy-based intervals. If the operating system allows the user to consecutively reuse their password when the password has exceeded its defined lifetime, the end result is a password that is not changed, per policy requirements.

Check Content

Determine if the password history setting is configured properly. # grep ^HISTORY /etc/default/passwd If HISTORY is commented out or is not set to 5 or more, this is a finding.

Fix Text

The root role is required. # pfedit /etc/default/passwd Locate the line containing: HISTORY Change the line to read: HISTORY=5

Additional Identifiers

Rule ID: SV-216090r603268_rule

Vulnerability ID: V-216090

Group Title: SRG-OS-000077

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.