To check the maximum value for consecutive repeating characters, run the following command:
$ grep pam_cracklib /etc/pam.d/system-auth
Look for the value of the "maxrepeat" parameter. The DoD requirement is 3. If maxrepeat is not found or not set to the required value, this is a finding.
Fix Text (F-43642r2_fix)
The pam_cracklib module's "maxrepeat" parameter controls requirements for consecutive repeating characters. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters. Add "maxrepeat=3" after pam_cracklib.so to prevent a run of (3 + 1) or more identical characters.