The Red Hat Enterprise Linux operating system must be configured so that passwords are prohibited from reuse for a minimum of five generations.

An XCCDF Rule

Description

Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If the information system or application allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed per policy requirements.

ID: SV-204422r917818_rule
Version: RHEL-07-010270
Severity: Medium
References: CCI-000200
Updated: 5 days ago

Remediation Templates

Configure the operating system to prohibit password reuse for a minimum of five generations.

Add the following line in "/etc/pam.d/system-auth" (or modify the line to have the required value):

password     requisite     pam_pwhistory.so remember=5 retry=3
Add the following line in "/etc/pam.d/password-auth" (or modify the line to have the required value):

password     requisite     pam_pwhistory.so use_authtok remember=5 retry=3
   
Note: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility; otherwise, manual changes to the listed files will be overwritten whenever the authconfig utility is used.

The Red Hat Enterprise Linux operating system must be configured so that passwords are prohibited from reuse for a minimum of five generations.

Description

Remediation Templates

A Manual Procedure