Detections
Analytics
5.3.2.2.2 Ensure password number of changed characters is configured
Information
The pwquality difok option sets the number of characters in a password that must not be present in the old password.More information about the pam_pwquality.so module configuration files, their location, and load preference is available in the section overview.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.
Solution
Create or modify a file ending in .conf in the /etc/security/pwquality.conf.d/ directory add or modify the following line to set difok to 2 or more. Ensure setting conforms to local site policy:difok = 2
Example
#!/usr/bin/env bash
{
sed -ri 's/^\s*difok\s*=/# &/' /etc/security/pwquality.conf 2>/dev/null
[ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/
printf '\n%s' "difok = 2" > /etc/security/pwquality.conf.d/50-pwdifok.conf
}
See Also
Item Details
Audit Name: CIS SUSE Linux Enterprise 16 v1.0.0 L1 Server
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4
Plugin: Unix
Control ID: 076a70fefcc145a0e84d259780b1b7447d1ee5470a44cee4a3208a7c8375f8ba