5.4.11 Ensure password prohibited reuse is at a minimum 5

Information

The operating system must be configured so that passwords are prohibited from reuse for a minimum of 5 generations.

Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If the information system or application allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed per policy requirements.

Solution

To configure the operating system to prohibit password reuse for a minimum of 5 generations.

Add the following line in /etc/pam.d/system-auth and /etc/pam.d/password-auth (or modify the line to have the required value):

Example: vim /etc/pam.d/system-auth

Add, uncomment or update the following line:

password requisite pam_pwhistory.so use_authtok remember=5 retry=3

Note: Manual changes to the listed files may be overwritten by the authconfig program. The authconfig program should not be used to update the configurations listed in this requirement.

See Also

https://workbench.cisecurity.org/benchmarks/8415

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 857074f06286430e549a100123565793f021d698e4a1c8795ddec7e5a7ae34d5