The macOS system must prohibit password reuse for a minimum of five generations.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-81737	AOSX-13-002090	SV-96451r1_rule		Medium

Description
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If the information system or application allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed as per policy requirements.

STIG	Date
Apple OS X 10.13 Security Technical Implementation Guide	2019-03-08

Details

Check Text ( C-81517r1_chk )
Password policy can be set with the "Password Policy" configuration profile or the "pwpolicy" utility. If password policy is set with a configuration profile, run the following command to check if the system is configured to require that users cannot reuse one of their five previously used passwords: /usr/sbin/system_profiler SPConfigurationProfileDataType \| /usr/bin/grep pinHistory If the return in null or not “pinHistory = 5” or greater, this is a finding. If password policy is set with the "pwpolicy" utility, run the following command instead: /usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies Look for the line "policyCategoryPasswordContent". If it does not exist, and password policy is not controlled by a directory service, this is a finding. Otherwise, in the array section that follows it, there should be a section that contains a check such as "none policyAttributePasswordHashes in policyAttributePasswordHistory". This searches for the hash of the user-entered password in the list of previous password hashes. In the "policyParameters" section that follows it, "policyAttributePasswordHistoryDepth" must be set to "5" or greater. If this parameter is not set to "5" or greater, or if no such check exists, this is a finding.

Check Text ( C-81517r1_chk )

Password policy can be set with the "Password Policy" configuration profile or the "pwpolicy" utility. If password policy is set with a configuration profile, run the following command to check if the system is configured to require that users cannot reuse one of their five previously used passwords:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep pinHistory

If the return in null or not “pinHistory = 5” or greater, this is a finding.

If password policy is set with the "pwpolicy" utility, run the following command instead:

/usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies

Look for the line "policyCategoryPasswordContent".

If it does not exist, and password policy is not controlled by a directory service, this is a finding.

Otherwise, in the array section that follows it, there should be a section that contains a check such as "none policyAttributePasswordHashes in policyAttributePasswordHistory". This searches for the hash of the user-entered password in the list of previous password hashes. In the "policyParameters" section that follows it, "policyAttributePasswordHistoryDepth" must be set to "5" or greater.

If this parameter is not set to "5" or greater, or if no such check exists, this is a finding.

Fix Text (F-88585r1_fix)
This setting may be enforced using the "Passcode Policy" configuration profile or by a directory service. To set the password policy without a configuration profile, run the following command to save a copy of the current "pwpolicy" account policy file: /usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies \| tail -n +2 > pwpolicy.plist Open the generated file in a text editor. If the file does not yet contain any policy settings, replace with . If there already is a policy block that refers to password history, ensure it is set to "5". If the line "policyCategoryPasswordContent" is not present in the file, add the following text immediately after the opening tag in the file: policyCategoryPasswordContent policyContent none policyAttributePasswordHashes in policyAttributePasswordHistory policyIdentifier Password History policyParameters policyAttributePasswordHistoryDepth 5 If the line "policyCategoryPasswordContent" is already present in the file, the following text should be added just after the opening tag that follows the line instead: policyContent none policyAttributePasswordHashes in policyAttributePasswordHistory policyIdentifier Password History policyParameters policyAttributePasswordHistoryDepth 5 After saving the file and exiting to the command prompt, run the following command to load the new policy file: /usr/bin/sudo /usr/bin/pwpolicy setaccountpolicies pwpolicy.plist Note: Updates to password restrictions must be thoroughly evaluated in a test environment. Mistakes in configuration may block password change and local user creation operations, as well as lock out all local users, including administrators.

Fix Text (F-88585r1_fix)

This setting may be enforced using the "Passcode Policy" configuration profile or by a directory service.

To set the password policy without a configuration profile, run the following command to save a copy of the current "pwpolicy" account policy file:

/usr/bin/sudo /usr/bin/pwpolicy getaccountpolicies | tail -n +2 > pwpolicy.plist

Open the generated file in a text editor. If the file does not yet contain any policy settings, replace with . If there already is a policy block that refers to password history, ensure it is set to "5". If the line "policyCategoryPasswordContent" is not present in the file, add the following text immediately after the opening tag in the file:

policyCategoryPasswordContent

policyContent
none policyAttributePasswordHashes in policyAttributePasswordHistory
policyIdentifier
Password History
policyParameters

policyAttributePasswordHistoryDepth
5

If the line "policyCategoryPasswordContent" is already present in the file, the following text should be added just after the opening tag that follows the line instead:

policyContent
none policyAttributePasswordHashes in policyAttributePasswordHistory
policyIdentifier
Password History
policyParameters

policyAttributePasswordHistoryDepth
5

After saving the file and exiting to the command prompt, run the following command to load the new policy file:

/usr/bin/sudo /usr/bin/pwpolicy setaccountpolicies pwpolicy.plist

Note: Updates to password restrictions must be thoroughly evaluated in a test environment. Mistakes in configuration may block password change and local user creation operations, as well as lock out all local users, including administrators.