[PATCH] Some corrections to the PAM cracklib guidance as follows

Maura Dailey maura at eclipse.ncsc.mil
Tue Jun 18 20:31:21 UTC 2013


Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
---
 RHEL6/input/system/accounts/pam.xml |   11 ++++++-----
 1 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 98dd568..f754743 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -107,7 +107,8 @@ character, lowercase character, digit, and other (special)
 character, locate the following line in <tt>/etc/pam.d/system-auth</tt>:
 <pre>password requisite pam_cracklib.so try_first_pass retry=3</pre>
 and then alter it to read:
-<pre>password required pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0</pre>
+<pre>password required pam_cracklib.so try_first_pass retry=3 maxrepeat=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4</pre>
+If no such line exists, add one as the first line of the password section in <tt>/etc/pam.d/system-auth</tt>.
 The arguments can be modified to ensure compliance with
 your organization's security policy. Discussion of each parameter follows.
 </description>
@@ -250,14 +251,14 @@ is different from account lockout, which is provided by the pam_faillock module.
 <Rule id="password_require_consecrepeat">
 <title>Set Password to Maximum of Three Consecutive Repeating Characters</title>
 <description>The pam_cracklib module's <tt>maxrepeat</tt> parameter controls requirements for
-consecutive repeating characters.  Edit the <tt>/etc/pam.d/system-auth</tt> file to include the following 
-line prior to the <tt>password include system-auth</tt> line:
-<pre>password required pam_cracklib.so maxrepeat=3</pre>
+consecutive repeating characters. When set to a positive number, it will reject passwords
+which contain more than that number of consecutive characters. Add <tt>maxrepeat=3</tt>
+after pam_cracklib.so to prevent a run of four or more identical characters.
 </description>
 <ocil clause="maxrepeat is not found or not set to the required value">
 To check the maximum value for consecutive repeating characters, run the following command:
 <pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
-Look for the value of the <tt>maxrepeat</tt> parameter.  The DoD requirement is 3.
+Look for the value of the <tt>maxrepeat</tt> parameter. The DoD requirement is 3.
 </ocil>
 <rationale>
 Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks.
-- 
1.7.1



More information about the scap-security-guide mailing list