[PATCH 1/4] added new Value for remembering 24 passwords * which increases number of hashes that can be harvested at any one time * and is apparently also some kind of policy requirement

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Jul 30 23:02:09 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 RHEL6/input/system/accounts/pam.xml |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 5be75e2..97193d9 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -53,6 +53,7 @@ frequently.</description>
 <value selector="0">0</value>
 <value selector="5">5</value>
 <value selector="10">10</value>
+<value selector="24">24</value>
 </Value>
 
 <Group id="password_quality">
@@ -361,7 +362,10 @@ the password line which uses the <tt>pam_unix</tt> module in the file
 <tt>/etc/pam.d/system-auth</tt>, as shown:
 <pre>password sufficient pam_unix.so existing_options remember=<sub idref="password_history_retain_number" /></pre>
 Old (and thus no longer valid) passwords are stored in the
-file <tt>/etc/security/opasswd</tt>.</description>
+file <tt>/etc/security/opasswd</tt>.  The DoD requirement is currently 24 passwords.</description>
+<rationale>
+Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.
+</rationale>
 <ident cce="14939-3" />
 <oval id="accounts_password_reuse_limit" value="password_history_retain_number" />
 <ref nist="IA-5" disa="200" />
-- 
1.7.1



More information about the scap-security-guide mailing list