Detections
Analytics

5.3.3.2.5 Ensure password maximum sequential characters is configured

Information

The pwquality maxsequence option sets the maximum length of monotonic character sequences in the new password. Examples of such sequence are 12345 or fedcb . The check is disabled if the value is 0.

Note: Most such passwords will not pass the simplicity check unless the sequence is only a minor part of the password.

Monotonic character sequences such as 12345, abcde, or a keyboard walk are predictable and are commonly attempted by password-guessing tools. Limiting the maximum length of such a sequence in a new password removes an easily guessed construction pattern.

Solution

Create or modify a file ending in .conf in the /etc/security/pwquality.conf.d/ directory or the file /etc/security/pwquality.conf and add or modify the following line to set maxsequence to 3 or less and not 0 . Ensure setting conforms to local site policy:

Example:

# sed -ri 's/^\s*maxsequence\s*=/# &/' /etc/security/pwquality.conf
# printf '%s\n' "" "maxsequence = 3" >> /etc/security/pwquality.conf.d/50-pwmaxsequence.conf

Run the following script to remove setting maxsequence on the pam_pwquality.so module in the PAM files:

#!/usr/bin/env bash

{
 for l_pam_file in system-auth password-auth; do
 l_authselect_file="/etc/authselect/$(head -1 /etc/authselect/authselect.conf | grep 'custom/')/$l_pam_file"
 sed -ri 's/(^\s*password\s+(requisite|required|sufficient)\s+pam_pwquality\.so.*)(\s+maxsequence\s*=\s*\S+)(.*$)/\1\4/' "$l_authselect_file"
 done
 authselect apply-changes
}

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 2948e272b565f944dd61e90841cfd737868f3badb32d50098f53200c3fb5be5a