Detections
Analytics
5.3.3.2.4 Ensure password same consecutive characters is configured
Information
The pwquality maxrepeat option sets the maximum number of allowed same consecutive characters in a new password.Long runs of a single repeated character are low in entropy and are among the first patterns tried by password-guessing tools. Limiting the number of consecutive identical characters allowed in a password forces greater variety and increases the difficulty of guessing it.
Solution
Create or modify a file ending in .conf in the /etc/security/pwquality.conf.d/ directory or the file /etc/security/pwquality.conf and add or modify the following line to set maxrepeat to 3 or less and not 0 . Ensure setting conforms to local site policy:Example:
# sed -ri 's/^\s*maxrepeat\s*=/# &/' /etc/security/pwquality.conf
# printf '%s\n' "" "maxrepeat = 3" >> /etc/security/pwquality.conf.d/50-pwrepeat.conf
Run the following script to remove setting maxrepeat on the pam_pwquality.so module in the PAM files:
#!/usr/bin/env bash
{
for l_pam_file in system-auth password-auth; do
l_authselect_file="/etc/authselect/$(head -1 /etc/authselect/authselect.conf | grep 'custom/')/$l_pam_file"
sed -ri 's/(^\s*password\s+(requisite|required|sufficient)\s+pam_pwquality\.so.*)(\s+maxrepeat\s*=\s*\S+)(.*$)/\1\4/' "$l_authselect_file"
done
authselect apply-changes
}
See Also
Item Details
Audit Name: CIS Red Hat Enterprise Linux 9 v3.0.0 L1 Server
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4
Plugin: Unix
Control ID: 6c9a679d7368e26c8b1d5330d9768e6f03605d181c9cd74c317064776dd7fc58