← Back to Solaris 11 X86 Security Technical Implementation Guide

V-216091

CAT II (Medium)

The system must require at least eight characters be changed between the old and new passwords during a password change.

Rule ID

SV-216091r1016286_rule

STIG

Solaris 11 X86 Security Technical Implementation Guide

Version

V3R5

CCIs

CCI-004066 CCI-000195

Discussion

To ensure password changes are effective in their goals, the system must ensure old and new passwords have significant differences. Without significant changes, new passwords may be easily guessed based on the value of a previously compromised password.

Check Content

Check /etc/default/passwd to verify the MINDIFF setting.

# grep ^MINDIFF /etc/default/passwd

If the setting is not present, or is less than eight, this is a finding.

Fix Text

The root role is required.

# pfedit /etc/default/passwd 

Search for MINDIFF. Change the line to read:

MINDIFF=8