| name | cis-ubuntu2004-v300-5-3-3-2-1 |
| description | Ensure password number of changed characters is configured |
| category | cis-iam |
| version | 3.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-20.04","pam","authentication"] |
| cis_id | 5.3.3.2.1 |
| cis_benchmark | CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
5.3.3.2.1 Ensure password number of changed characters is configured (Automated)
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Description
The pwquality difok option sets the number of characters in a password that must not be present in the old password.
Rationale
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.
Audit Procedure
Command Line
Run the following command to verify that the difok option is set to 2 or more and follows local site policy:
Example output:
/etc/security/pwquality.conf.d/50-pwdifok.conf:difok = 2
Verify returned value(s) are 2 or more and meet local site policy.
Run the following command to verify that difok is not set, is 2 or more, and conforms to local site policy:
grep -Psi -- '^\h*password\h+(requisite|required|sufficient)\h+pam_pwquality\.so\h+([^#\n\r]+\h+)?difok\h*=\h*([0-1])\b' /etc/pam.d/common-password
Nothing should be returned.
Note:
- settings should be configured in only one location for clarity
- Settings observe an order of precedence:
- module arguments override the settings in the
/etc/security/pwquality.conf configuration file
- settings in the
/etc/security/pwquality.conf configuration file override settings in a .conf file in the /etc/security/pwquality.conf.d/ directory
- settings in a
.conf file in the /etc/security/pwquality.conf.d/ directory are read in canonical order, with last read file containing the setting taking precedence
- It is recommended that settings be configured in a file in the directory for clarity, convenience, and durability.
