The system must require at least four characters be changed between the old and new passwords during a password change.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22306	GEN000750	SV-44881r1_rule	IAIA-1 IAIA-2	Medium

Description
To ensure password changes are effective in their goals, the system must ensure that old and new passwords have significant differences. Without significant changes, new passwords may be easily guessed based on the value of a previously compromised password.

STIG	Date
SUSE Linux Enterprise Server v11 for System z	2012-12-13

Details

Check Text ( C-42335r1_chk )
Check /etc/pam.d/system-auth for a pam_cracklib parameter difok. Procedure: # grep difok /etc/pam.d/common-password If difok is not present, or has a value less than 4, this is a finding. Check for common-password-pc inclusions. # grep -c common-password-pc /etc/pam.d/* If the common-password-pc file is included anywhere # more /etc/pam.d/common-password-pc \| grep difok If common-password-pc is included anywhere and difok is not present, or has a value less than 4, this is a finding. Ensure the passwd command uses the common-password settings. # grep common-password /etc/pam.d/passwd If a line "password include common-password" is not found then the password checks in common-password will not be applied to new passwords.

Check Text ( C-42335r1_chk )

Check /etc/pam.d/system-auth for a pam_cracklib parameter difok.

Procedure:
# grep difok /etc/pam.d/common-password
If difok is not present, or has a value less than 4, this is a finding.

Check for common-password-pc inclusions.
# grep -c common-password-pc /etc/pam.d/*

If the common-password-pc file is included anywhere
# more /etc/pam.d/common-password-pc | grep difok

If common-password-pc is included anywhere and difok is not present, or has a value less than 4, this is a finding.

Ensure the passwd command uses the common-password settings.
# grep common-password /etc/pam.d/passwd
If a line "password include common-password" is not found then the password checks in common-password will not be applied to new passwords.

Fix Text (F-38313r1_fix)
Edit /etc/pam.d/common-password and add or edit a pam_cracklib entry with a difok parameter set equal to or greater than 4.