>From 8777746dc8d732460fda0f71b8fec38d33c81200 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Thu, 25 Apr 2013 20:28:18 -0400 Subject: [PATCH 47/64] Mapped IA-5(1)(e) to password_history_retain - Updated XCCDF to reflect FISMA following DOD regulation of 24 passwords - Since DoD and FISMA both require a value of 24, setting that to default value --- RHEL6/input/system/accounts/pam.xml | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index 1e82c6d..f9b6435 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -48,7 +48,7 @@ operator="equals" interactive="0"> /etc/security/opasswd in order to force password change history and keep the user from alternating between the same password too frequently. -5 +24 0 5 10 @@ -495,7 +495,7 @@ be accomplished by using the remember option for the pam_unix module. In the file /etc/pam.d/system-auth, append remember=24 to the line which refers to the pam_unix.so module, as shown:
password sufficient pam_unix.so existing_options remember=24
-The DoD requirement is 24 passwords. +The DoD and FISMA requirement is 24 passwords. To verify the password reuse setting is compliant, run the following command:
$ grep remember /etc/pam.d/system-auth
@@ -507,7 +507,7 @@ Preventing re-use of previous passwords helps ensure that a compromised password - + -- 1.7.1