The system must require at least eight characters be changed between the old and new passwords during a password change.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-38572	RHEL-06-000060	SV-50373r2_rule		Low

Description
Requiring a minimum number of different characters during password changes ensures that newly changed passwords should not resemble previously compromised ones. Note that passwords which are changed on compromised systems will still be compromised, however.

STIG	Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide	2015-09-09

Details

Check Text ( None )
None

Fix Text (F-43520r2_fix)
The pam_cracklib module's "difok" parameter controls requirements for usage of different characters during a password change. Add "difok=[NUM]" after pam_cracklib.so to require differing characters when changing passwords, substituting [NUM] appropriately. The DoD requirement is 8.