The system must require at least eight characters be changed between the old and new passwords during a password change.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-208835	OL6-00-000060	SV-208835r793620_rule		Low

Description
Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note: Passwords which are changed on compromised systems will still be compromised.

STIG	Date
Oracle Linux 6 Security Technical Implementation Guide	2021-12-03

Details

Check Text ( C-9088r357485_chk )
To check how many characters must differ during a password change, run the following command: $ grep pam_cracklib /etc/pam.d/system-auth /etc/pam.d/password-auth The "difok" parameter will indicate how many characters must differ. The DoD requires eight characters differ during a password change. This would appear as "difok=8". If the “difok” parameter is not found or not set to the required value, this is a finding.

Check Text ( C-9088r357485_chk )

To check how many characters must differ during a password change, run the following command:

$ grep pam_cracklib /etc/pam.d/system-auth /etc/pam.d/password-auth

The "difok" parameter will indicate how many characters must differ. The DoD requires eight characters differ during a password change. This would appear as "difok=8".

If the “difok” parameter is not found or not set to the required value, this is a finding.

Fix Text (F-9088r357486_fix)
The pam_cracklib module's "difok" parameter controls requirements for usage of different characters during a password change. Edit /etc/pam.d/system-auth and /etc/pam.d/password-auth adding "difok=[NUM]" after pam_cracklib.so to require differing characters when changing passwords, substituting [NUM] appropriately. The DoD requirement is “8”.