Detections
Analytics

5.3.3.3.2 Ensure password history is enforced for the root user

Information

If the pwhistory enforce_for_root option is enabled, the module will enforce password history for the root user as well

By default the password-history check does not apply to the root account, so root can be changed back to a recently used password even when history enforcement is configured for other users. Enabling enforce_for_root subjects root's password changes to the same history check. Because the root account is a high-value target, preventing reuse of a recent - and possibly compromised - root password closes that gap.

Solution

Edit or add the following line in /etc/security/pwhistory.conf :

enforce_for_root

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 074bcc8f585c20ce115e4c4fc23c7829c9aabca4eb1407e62b83f727ecbb95a0