documentation_complete: true

prodtype: rhel7,fedora

title: 'Set Password to Maximum of Consecutive Repeating Characters from Same Character Class'

description: |-
    The pam_pwquality module's <tt>maxclassrepeat</tt> parameter controls requirements for
    consecutive repeating characters from the same character class. When set to a positive number, it will reject passwords
    which contain more than that number of consecutive characters from the same character class. Modify the
    <tt>maxclassrepeat</tt> setting in <tt>/etc/security/pwquality.conf</tt> to equal <sub idref="var_password_pam_maxclassrepeat" />
    to prevent a run of (<sub idref="var_password_pam_maxclassrepeat" /> + 1) or more identical characters.

rationale: |-
    Use of a complex password helps to increase the time and resources required to comrpomise the password.
    Password complexity, or strength, is a measure of the effectiveness of a password in resisting
    attempts at guessing and brute-force attacks.
    <br />
    Password complexity is one factor of several that determines how long it takes to crack a password. The
    more complex a password, the greater the number of possible combinations that need to be tested before the
    password is compromised.

severity: medium

identifiers:
    cce@rhel7: 27512-3

references:
    disa: 195
    nist: IA-5,IA-5(c)
    srg: SRG-OS-000072-GPOS-00040
    stigid@rhel7: "010190"

ocil_clause: 'that is not the case'

ocil: |-
    To check the value for maximum consecutive repeating characters, run the following command:
    <pre>$ grep maxclassrepeat /etc/security/pwquality.conf</pre>
    For DoD systems, the output should show <tt>maxclassrepeat</tt>=4.
