Detections
Analytics

5.3.3.3.2 Ensure password history is enforced for the root user

Information

If the pwhistory enforce_for_root option is enabled, the module will enforce password history for the root user as well

By default the password-history check does not apply to the root account, so root can be changed back to a recently used password even when history enforcement is configured for other users. Enabling enforce_for_root subjects root's password changes to the same history check. Because the root account is a high-value target, preventing reuse of a recent - and possibly compromised - root password closes that gap.

Solution

Edit or add the following line in /etc/security/pwhistory.conf :

enforce_for_root

See Also

https://workbench.cisecurity.org/benchmarks/27893

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 27261a8d7c31bcc963055704b9b51e6a23216149e57da7f9a9cf4367f3816c5f