Detections
Analytics
5.3.3.2.1 Ensure password number of changed characters is configured
Information
The pwquality difok option sets the number of characters in a password that must not be present in the old password.A new password that differs from the previous password in only a few characters can be trivially derived from a known, compromised, or expired password. Requiring that a minimum number of characters differ from the old password prevents users from making minor, predictable variations of a prior password when it is changed.
Solution
Create or modify a file ending in .conf in the /etc/security/pwquality.conf.d/ directory or the file /etc/security/pwquality.conf and add or modify the following line to set difok to 2 or more. Ensure setting conforms to local site policy:difok = 2
Example:
# sed -ri 's/^\s*difok\s*=/# &/' /etc/security/pwquality.conf
# printf '%s\n' "" "difok = 2" >> /etc/security/pwquality.conf.d/50-pwdifok.conf
Run the following script to remove setting difok on the pam_pwquality.so module in the PAM files:
#!/usr/bin/env bash
{
for l_pam_file in system-auth password-auth; do
l_authselect_file="/etc/authselect/$(head -1 /etc/authselect/authselect.conf | grep 'custom/')/$l_pam_file"
sed -ri 's/(^\s*password\s+(requisite|required|sufficient)\s+pam_pwquality\.so.*)(\s+difok\s*=\s*\S+)(.*$)/\1\4/' "$l_authselect_file"
done
authselect apply-changes
}
See Also
Item Details
Audit Name: CIS AlmaLinux OS 9 v3.0.0 L1 Server
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4
Plugin: Unix
Control ID: bc8270fe19ef600bab50fcd474b79cf33ca48ac694710b15a2284c84575b9416