documentation_complete: true

prodtype: rhel7,fedora

title: 'Set Password Strength Minimum Different Characters'

description: "The pam_pwquality module's <tt>difok</tt> parameter sets the number of characters\nin a password that must not be present in and old password during a password change. \n<br /><br />\nModify the <tt>difok</tt> setting in <tt>/etc/security/pwquality.conf</tt>\nto equal <sub idref=\"var_password_pam_difok\" /> to require differing characters \nwhen changing passwords."

rationale: "Use of a complex password helps to increase the time and resources \nrequired to compromise the password. Password complexity, or strength, \nis a measure of the effectiveness of a password in resisting attempts \nat guessing and brute–force attacks.\n<br /><br />\nPassword complexity is one factor of several that determines how long \nit takes to crack a password. The more complex the password, the \ngreater the number of possible combinations that need to be tested \nbefore the password is compromised.\n<br /><br />\nRequiring a minimum number of different characters during password changes ensures that\nnewly changed passwords should not resemble previously compromised ones.\nNote that passwords which are changed on compromised systems will still be compromised, however."

severity: medium

identifiers:
    cce@rhel7: 26631-2

references:
    cjis: 5.6.2.1.1
    disa: 195
    nist: IA-5(b),IA-5(c),IA-5(1)(b)
    srg: SRG-OS-000072-GPOS-00040
    stigid@rhel7: "010160"

ocil_clause: 'difok is not found or not equal to or greater than the required value'

ocil: |-
    To check how many characters must differ during a password change, run the following command:
    <pre>$ grep difok /etc/security/pwquality.conf</pre>
    The <tt>difok</tt> parameter will indicate how many characters must differ.
