Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The system must require passwords to contain no more than three consecutive repeating characters.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-38693 | RHEL-06-000299 | SV-50494r2_rule | Low |
| Description |
|---|
| Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks. |
| STIG | Date |
|---|---|
| Red Hat Enterprise Linux 6 Security Technical Implementation Guide | 2015-12-03 |
Details
| Check Text ( C-46255r1_chk ) |
|---|
| To check the maximum value for consecutive repeating characters, run the following command: $ grep pam_cracklib /etc/pam.d/system-auth Look for the value of the "maxrepeat" parameter. The DoD requirement is 3. If maxrepeat is not found or not set to the required value, this is a finding. |
| Fix Text (F-43642r2_fix) |
|---|
| The pam_cracklib module's "maxrepeat" parameter controls requirements for consecutive repeating characters. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters. Add "maxrepeat=3" after pam_cracklib.so to prevent a run of (3 + 1) or more identical characters. password required pam_cracklib.so maxrepeat=3 |