The ESXi host must prohibit the reuse of passwords within five iterations.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-94011	ESXI-65-000032	SV-104097r1_rule		Medium

Description
If a user, or root, used the same password continuously or was allowed to change it back shortly after being forced to change it to something else, it would provide a potential intruder with the opportunity to keep guessing at one user's password until it was guessed correctly.

STIG	Date
VMware vSphere 6.5 ESXi Security Technical Implementation Guide	2019-12-13

Details

Check Text ( C-93329r1_chk )
From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command: # grep -i "^password" /etc/pam.d/passwd | grep sufficient If the remember setting is not set or is not "remember=5", this is a finding.

Fix Text (F-100259r1_fix)
From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in “/etc/pam.d/passwd”: password sufficient /lib/security/$ISA/pam_unix.so use_authtok nullok shadow sha512 remember=5