Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-4084 | GEN000800 | SV-44884r1_rule | Medium |
Description |
---|
If a user, or root, used the same password continuously or was allowed to change it back shortly after being forced to change it to something else, it would provide a potential intruder with the opportunity to keep guessing at one user's password until it was guessed correctly. |
STIG | Date |
---|---|
SUSE Linux Enterprise Server v11 for System z | 2016-12-20 |
Check Text ( C-42338r1_chk ) |
---|
# pam-config -q --pwhistory If the result is not’ password: remember=5’ or higher, then this is a finding. # ls /etc/security/opasswd If /etc/security/opasswd does not exist, then this is a finding. # grep password /etc/pam.d/common-password| grep pam_pwhistory.so | grep remember If the "remember" option in /etc/pam.d/common-password is not 5 or greater, this is a finding. |
Fix Text (F-38316r1_fix) |
---|
Create the password history file. # touch /etc/security/opasswd # chown root:root /etc/security/opasswd # chmod 0600 /etc/security/opasswd Configure pam to use password history. # pam-config -a --pwhistory # pam-config -a --pwhistory-remember=5 |