STIGQter: STIG Summary: Oracle Linux 6 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The system must require passwords to contain no more than three consecutive repeating characters.

DISA Rule

SV-209029r603263_rule

Vulnerability Number

V-209029

Group Title

SRG-OS-000480

Rule Version

OL6-00-000299

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

The pam_cracklib module's ”maxrepeat” parameter controls requirements for consecutive repeating characters. When set to a positive number, it will reject passwords that contain more than the number of consecutive characters.

Edit /etc/pam.d/system-auth and /etc/pam.d/password-auth adding "maxrepeat=3" after pam_cracklib.so to prevent a run of (3 + 1) or more identical characters.
password required pam_cracklib.so maxrepeat=3

Check Contents

To check the maximum value for consecutive repeating characters, run the following command:

$ grep pam_cracklib /etc/pam.d/system-auth /etc/pam.d/password-auth

Look for the value of the "maxrepeat" parameter. The DoD requirement is “3”.

If "maxrepeat" is not found, is set to zero, or is set to a value greater than “3”, this is a finding.

Vulnerability Number

V-209029

Documentable

False

Rule Version

OL6-00-000299

Severity Override Guidance

To check the maximum value for consecutive repeating characters, run the following command:

$ grep pam_cracklib /etc/pam.d/system-auth /etc/pam.d/password-auth

Look for the value of the "maxrepeat" parameter. The DoD requirement is “3”.

If "maxrepeat" is not found, is set to zero, or is set to a value greater than “3”, this is a finding.

Check Content Reference

M

Target Key

2928

Comments