UCF STIG Viewer Logo

The system must require at least four characters be changed between the old and new passwords during a password change.


Finding ID Version Rule ID IA Controls Severity
V-38572 RHEL-06-000060 SV-50373r1_rule Low
Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note that passwords which are changed on compromised systems will still be compromised, however.
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2015-05-26


Check Text ( C-46130r1_chk )
To check how many characters must differ during a password change, run the following command:

$ grep pam_cracklib /etc/pam.d/system-auth

The "difok" parameter will indicate how many characters must differ. The DoD requires four characters differ during a password change. This would appear as "difok=4".
If difok is not found or not set to the required value, this is a finding.
Fix Text (F-43520r1_fix)
The pam_cracklib module's "difok" parameter controls requirements for usage of different characters during a password change. Add "difok=[NUM]" after pam_cracklib.so to require differing characters when changing passwords, substituting [NUM] appropriately. The DoD requirement is 4.