download g. prohibit password reuse for 24 generations

Review AS documentation and configuration to determine if the AS prohibits password reuse for the defined number of password changes. When the AS utilizes user IDs and passwords, the AS must prohibit the reuse of the user's password for the organization defined number of password changes.Īpplication Server Security Requirements Guide

However, if the application server allows the user to reuse their password when that password has exceeded its defined lifetime, the end result is a defacto reuse of an existing password.Īpp servers have the capability to utilize LDAP, certificates (tokens), or user IDs and passwords in order to authenticate. To meet password policy requirements, passwords need to be changed at specific policy-based intervals. Password sufficient pam_unix.Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If the line containing the 'pam_unix.so' line does not have the 'remember' module argument set, or the value of the 'remember' module argument is set to less than '5', this is a finding.Ĭonfigure the operating system to prohibit password reuse for a minimum of five generations.Īdd the following line in '/etc/pam.d/system-auth-ac' (or modify the line to have the required value): Password sufficient pam_unix.so use_authtok sha512 shadow remember=5

# grep -i remember /etc/pam.d/system-auth-ac

Verify the operating system prohibits password reuse for a minimum of five generations.Ĭheck for the value of the 'remember' argument in '/etc/pam.d/system-auth-ac' with the following command: Red Hat Enterprise Linux 7 Security Technical Implementation Guide If the information system or application allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed per policy requirements. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Download g. prohibit password reuse for 24 generations