documentation_complete: true

prodtype: rhel7,fedora

title: 'Set Password Maximum Consecutive Repeating Characters'

description: "The pam_pwquality module's <tt>maxrepeat</tt> parameter controls requirements for\nconsecutive repeating characters. When set to a positive number, it will reject passwords\nwhich contain more than that number of consecutive characters. Modify the <tt>maxrepeat</tt> setting\nin <tt>/etc/security/pwquality.conf</tt> to equal <sub idref=\"var_password_pam_maxrepeat\" /> to prevent a \nrun of (<sub idref=\"var_password_pam_maxrepeat\" /> + 1) or more identical characters."

rationale: "Use of a complex password helps to increase the time and resources required to compromise the password. \nPassword complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at \nguessing and brute-force attacks.\n<br /><br />\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more\ncomplex the password, the greater the number of possible combinations that need to be tested before the\npassword is compromised.\n<br /><br />\nPasswords with excessive repeating characters may be more vulnerable to password-guessing attacks."

severity: medium

identifiers:
    cce@rhel7: 27333-4

references:
    disa: 195
    nist: IA-5,IA-5(c)
    srg: SRG-OS-000072-GPOS-00040
    stigid@rhel7: "010180"

ocil_clause: 'maxrepeat is not found or not greater than or equal to the required value'

ocil: |-
    To check the maximum value for consecutive repeating characters, run the following command:
    <pre>$ grep maxrepeat /etc/security/pwquality.conf</pre>
    Look for the value of the <tt>maxrepeat</tt> parameter. The DoD requirement is 2, which would appear as
    <tt>maxrepeat=2</tt>.
