Detections
Analytics
5.3.2.2.6 Ensure password maximum sequential characters is configured
Information
The pwquality maxsequence option sets the maximum length of monotonic character sequences in the new password. Examples of such sequence are 12345 or fedcb . The check is disabled if the value is 0.Note: Most such passwords will not pass the simplicity check unless the sequence is only a minor part of the password.
More information about the pam_pwquality.so module configuration files, their location, and load preference is available in the section overview.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.
Solution
Create or modify a file ending in .conf in the /etc/security/pwquality.conf.d/ directory and add or modify the following line to set maxsequence to 3 or less and not 0 . Ensure setting conforms to local site policy:maxsequence = 3
Example:
#!/usr/bin/env bash
{
sed -ri 's/^\s*maxsequence\s*=/# &/' /etc/security/pwquality.conf 2>/dev/null
[ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/
printf '\n%s' "maxsequence = 3" > /etc/security/pwquality.conf.d/50-pwmaxsequence.conf
}
See Also
Item Details
Audit Name: CIS SUSE Linux Enterprise 16 v1.0.0 L1 Server
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4
Plugin: Unix
Control ID: 38a623d2477178946b0e12260f86d385544c4583c57cc348b175efbbd64f6158