Detections
Analytics
5.3.2.2.6 Ensure password maximum sequential characters is configured
Information
The pwquality maxsequence option sets the maximum length of monotonic character sequences in the new password. Examples of such sequence are 12345 or fedcb . The check is disabled if the value is 0.Note: Most such passwords will not pass the simplicity check unless the sequence is only a minor part of the password.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.
Solution
Create or modify a file ending in .conf in the /etc/security/pwquality.conf.d/ directory or the file /etc/security/pwquality.conf and add or modify the following line to set maxsequence to 3 or less and not 0 . Ensure setting conforms to local site policy:Example:
# sed -ri 's/^\s*maxsequence\s*=/# &/' /etc/security/pwquality.conf
# printf '\n%s' "maxsequence = 3" >> /etc/security/pwquality.conf.d/50-pwmaxsequence.conf
- OR/IF - the pam-config tool has been used to configure the global PAM configuration files.
Run the following command to set maxsequence to 3 or less and not 0 . Ensure setting conforms to local site policy:
Example:
# pam-config -a --cracklib-maxsequence=3
See Also
Item Details
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4
Plugin: Unix
Control ID: 7755970123f4b63f96da4b8e11886773e163984d59100efcbba6bb8d3dded72e