SV-218026r603264: The system must prohibit the reuse of passwords within five iterations. | Red Hat Enterprise Linux 6 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The system must prohibit the reuse of passwords within five iterations.

Description

Discussion Text

Preventing reuse of previous passwords helps ensure that a compromised password is not reused by a user.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000200CCE-26741-9V-38658SV-50459

References

DPMS Target Red Hat Enterprise Linux 6 DISA DPMS Target Red Hat Enterprise Linux 6 4046

Checks

DISA STIG (Manual Reference)

To verify the password reuse setting is compliant, run the following command:

# grep remember /etc/pam.d/system-auth /etc/pam.d/password-auth

If the line is commented out, the line does not contain "password required pam_pwhistory.so" or "password requisite pam_pwhistory.so", or the value for "remember" is less than “5”, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.redhat.rhel6:def:4002
# The system must prohibit the reuse of passwords within five iterations.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# Make sure password reuse setting is set to at least 5 in /etc/pam.d/system-auth and appears not first.
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  [ "$(sed -En 's/^\s*password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so[\t ]+[^#\n\r]*\s+remember=(\d+)(?:(?:\s)|(?:$))/\1/p' '/etc/pam.d/system-auth')" -ge 5 ]
}
# Make sure password reuse setting is set to at least 5 in /etc/pam.d/system-auth and appears first.
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  [ "$(sed -En 's/^\s*password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so\s+remember=(\d+)(?:(?:\s)|(?:$))/\1/p' '/etc/pam.d/system-auth')" -ge 5 ]
}
# Make sure password reuse setting is set to at least 5 in /etc/pam.d/password-auth and appears not first.
# textfilecontent54_object (textfilecontent54_test)
test_3() {
  [ "$(sed -En 's/^\s*password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so[\t ]+[^#\n\r]*\s+remember=(\d+)(?:(?:\s)|(?:$))/\1/p' '/etc/pam.d/password-auth')" -ge 5 ]
}
# Make sure password reuse setting is set to at least 5 in /etc/pam.d/password-auth and appears first.
# textfilecontent54_object (textfilecontent54_test)
test_4() {
  [ "$(sed -En 's/^\s*password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so\s+remember=(\d+)(?:(?:\s)|(?:$))/\1/p' '/etc/pam.d/password-auth')" -ge 5 ]
}

if ( ( test_1 || test_2 ) && ( test_3 || test_4 ) ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# oval:mil.disa.fso.redhat.rhel6:def:4002

if grep -qE '^\\s*password\\s+(?:(?:requisite)|(?:required))\\s+pam_pwhistory\\.so[\\t ]+[^#\\n\\r]*\\s+remember=5' /etc/pam.d/system-auth || grep -qE '^\\s*password\\s+(?:(?:requisite)|(?:required))\\s+pam_pwhistory\\.so\\s+remember=5' /etc/pam.d/system-auth || grep -qE '^\\s*password\\s+(?:(?:requisite)|(?:required))\\s+pam_pwhistory\\.so[\\t ]+[^#\\n\\r]*\\s+remember=5' /etc/pam.d/password-auth || grep -qE '^\\s*password\\s+(?:(?:requisite)|(?:required))\\s+pam_pwhistory\\.so\\s+remember=5' /etc/pam.d/password-auth
then
    echo "PASS"
    exit 0
else
    echo "FAIL"
    exit 1
fi

Remediation

Do not allow users to reuse recent passwords. This can be accomplished by using the "remember" option for the "pam_pwhistory" PAM module. In the file "/etc/pam.d/system-auth" and /etc/pam.d/password-auth, append "remember=5" to the lines that refer to the "pam_pwhistory.so" module, as shown:

password required pam_pwhistory.so [existing_options] remember=5

or

password requisite pam_pwhistory.so [existing_options] remember=5

The DoD requirement is five passwords.