UCF STIG Viewer Logo

The system must require passwords to contain no more than three consecutive repeating characters.


Finding ID Version Rule ID IA Controls Severity
V-218047 RHEL-06-000299 SV-218047r505923_rule Low
Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks.
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2020-09-03


Check Text ( C-19528r377156_chk )
To check the maximum value for consecutive repeating characters, run the following command:

$ grep pam_cracklib /etc/pam.d/system-auth /etc/pam.d/password-auth

Look for the value of the "maxrepeat" parameter.

If "maxrepeat" is not found, is set to zero, or is set to a value greater than "3", this is a finding.
Fix Text (F-19526r377157_fix)
The pam_cracklib module's "maxrepeat" parameter controls requirements for consecutive repeating characters. When set to a positive number, it will reject passwords which contain more than that number of consecutive characters.

Edit /etc/pam.d/system-auth and /etc/pam.d/password-auth adding "maxrepeat=3" after pam_cracklib.so to prevent a run of (3 + 1) or more identical characters.

password required pam_cracklib.so maxrepeat=3