The system must require at least eight characters be changed between the old and new passwords during a password change.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-216326 | SOL-11.1-040060 | SV-216326r1016271_rule | CCI-004066 | medium |
| Description | ||||
| To ensure password changes are effective in their goals, the system must ensure old and new passwords have significant differences. Without significant changes, new passwords may be easily guessed based on the value of a previously compromised password. | ||||
| STIG | Date | |||
| Solaris 11 SPARC Security Technical Implementation Guide | 2025-05-05 | |||
Related Frameworks
6 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
IA-5(1)
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1714 mappings
3.5.10
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.5.7
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.5.8
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.5.9
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-004066
1.00
- DISA · 3 · disa_xccdf · related
Details
Check Text (C-216326r1016271_chk)
Check /etc/default/passwd to verify the MINDIFF setting.
# grep ^MINDIFF /etc/default/passwd
If the setting is not present, or is less than 8, this is a finding.
Fix Text (F-17560r371067_fix)
The root role is required.
# pfedit /etc/default/passwd
Search for MINDIFF. Change the line to read:
MINDIFF=8