download g. prohibit password reuse for 24 generations

Password required pam_pwhistory.so use_authtok remember=5 retry=3 Check Contents

CCI-000200 - The information system prohibits password reuse for the organization-defined number of generations.Ĭonfigure the operating system to prohibit password reuse for a minimum of five generations.Īdd the following line in '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth' (or modify the line to have the required value):.Password required pam_pwhistory.STIGQter: STIG Summary: Red Hat Enterprise Linux 8 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: : RHEL 8 passwords must be prohibited from reuse for a minimum of five generations. If the line containing 'pam_pwhistory.so' does not have the 'remember' module argument set, is commented out, or the value of the 'remember' module argument is set to less than '5', this is a finding.Ĭonfigure the operating system to prohibit password reuse for a minimum of five generations.Īdd the following line in '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth' (or modify the line to have the required value): Password required pam_pwhistory.so use_authtok remember=5 retry=3

$ sudo grep -i remember /etc/pam.d/system-auth /etc/pam.d/password-auth Verify the operating system prohibits password reuse for a minimum of five generations.Ĭheck for the value of the 'remember' argument in '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth' with the following command: Red Hat Enterprise Linux 8 Security Technical Implementation Guideĭetails Check Text ( C-33037r567850_chk ) Note that manual changes to the listed files may be overwritten by the 'authselect' program. RHEL 8 utilizes 'pwquality' consecutively as a mechanism to enforce password complexity. If the information system or application allows the user to reuse their password consecutively when that password has exceeded its defined lifetime, the end result is a password that is not changed per policy requirements. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Download g. prohibit password reuse for 24 generations