documentation_complete: true

title: 'Set Password to Maximum of Three Consecutive Repeating Characters'

description: |-
    The pam_cracklib module's <tt>maxrepeat</tt> parameter controls requirements for
    consecutive repeating characters. When set to a positive number, it will reject passwords
    which contain more than that number of consecutive characters. Add <tt>maxrepeat=<sub idref="var_password_pam_maxrepeat" /></tt>
    after pam_cracklib.so to prevent a run of (<sub idref="var_password_pam_maxrepeat" /> + 1) or more identical characters:<br />
    <pre>password required pam_cracklib.so maxrepeat=<sub idref="var_password_pam_maxrepeat" /></pre>

rationale: 'Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks.'

severity: unknown

identifiers:
    cce: 27227-8

references:
    disa: 366
    nist: IA-5(c)
    srg: SRG-OS-999999
    stigid: RHEL-06-000299

ocil_clause: 'maxrepeat is not found or not set to the required value'

ocil: |-
    To check the maximum value for consecutive repeating characters, run the following command:
    <pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
    Look for the value of the <tt>maxrepeat</tt> parameter. The DoD requirement is 3.
