UCF STIG Viewer Logo

The system must require at least eight characters be changed between the old and new passwords during a password change.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22306 GEN000750 SV-44881r2_rule Medium
Description
To ensure password changes are effective in their goals, the system must ensure that old and new passwords have significant differences. Without significant changes, new passwords may be easily guessed based on the value of a previously compromised password.
STIG Date
SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide 2018-09-19

Details

Check Text ( C-42335r3_chk )
Check /etc/pam.d/common-{auth,account,password,session} for a ‘difok’ parameter on the pam_cracklib.so line.

Procedure:
# grep difok /etc/pam.d/common-{auth,account,password,session}
If difok is not present, or has a value less than 8, this is a finding.

Check for common-password inclusions.
# grep -c common-password /etc/pam.d/*

If the common-password file is included anywhere
# grep difok /etc/pam.d/common-password

If common-password is included anywhere and difok is not present, or has a value less than 8, this is a finding.

Ensure the passwd command uses the common-password settings.
# grep common-password /etc/pam.d/passwd
If a line "password include common-password" is not found then the password checks in common-password will not be applied to new passwords and this is a finding.
Fix Text (F-38313r3_fix)
Edit /etc/pam.d/common-password and add or edit a pam_cracklib.so entry with a difok parameter set equal to or greater than 8.