cis-ubuntu2004-v300-5-3-3-2-5

name	cis-ubuntu2004-v300-5-3-3-2-5
description	Ensure password maximum sequential characters is configured
category	cis-iam
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","pam","authentication"]
cis_id	5.3.3.2.5
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.3.3.2.5 Ensure password maximum sequential characters is configured (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

The pwquality maxsequence option sets the maximum length of monotonic character sequences in the new password. Examples of such sequence are 12345 or fedcb. The check is disabled if the value is 0.

Note: Most such passwords will not pass the simplicity check unless the sequence is only a minor part of the password.

Rationale

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Audit Procedure

Command Line

Run the following command to verify that the maxsequence option is set to 3 or less, not 0, and follows local site policy:

# grep -Psi -- '^\h*maxsequence\h*=\h*[1-3]\b' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf

Example output:

/etc/security/pwquality.conf.d/50-pwmaxsequence.conf:maxsequence = 3

Verify returned value(s) are 3 or less, not 0, and meet local site policy.

Run the following command to verify that maxsequence is not set, is 3 or less, not 0, and conforms to local site policy:

# grep -Psi -- '^\h*password\h+(requisite|required|sufficient)\h+pam_pwquality\.so\h+([^#\n\r]+\h+)?maxsequence\h*=\h*(0|[4-9]|[1-9][0-9]+)\b' /etc/pam.d/common-password

Nothing should be returned.

Note:

• settings should be configured in only one location for clarity
• Settings observe an order of precedence:
  • module arguments override the settings in the /etc/security/pwquality.conf configuration file
  • settings in the /etc/security/pwquality.conf configuration file override settings in a file in the directory