documentation_complete: true

title: 'Set Password Strength Minimum Different Characters'

description: |-
    The pam_cracklib module's <tt>difok</tt> parameter controls requirements for
    usage of different characters during a password change.
    Add <tt>difok=<i><sub idref="var_password_pam_difok" /></i></tt> after pam_cracklib.so to require differing
    characters when changing passwords. The DoD requirement is <tt>4</tt>.

rationale: |-
    Requiring a minimum number of different characters during password changes ensures that
    newly changed passwords should not resemble previously compromised ones.
    Note that passwords which are changed on compromised systems will still be compromised, however.

severity: unknown

identifiers:
    cce: 26615-5

references:
    disa: 195
    nist: IA-5(b),IA-5(c),IA-5(1)(b)
    srg: SRG-OS-000072
    stigid: RHEL-06-000060

ocil_clause: 'difok is not found or not set to the required value'

ocil: |-
    To check how many characters must differ during a password change, run the following command:
    <pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
    The <tt>difok</tt> parameter will indicate how many characters must differ.
    The DoD requires four characters differ during a password change.
    This would appear as <tt>difok=4</tt>.
