← Back to Solaris 11 SPARC Security Technical Implementation Guide

V-216326

CAT II (Medium)

The system must require at least eight characters be changed between the old and new passwords during a password change.

Rule ID

SV-216326r1016271_rule

STIG

Solaris 11 SPARC Security Technical Implementation Guide

Version

V3R5

CCIs

CCI-004066 CCI-000195

Discussion

To ensure password changes are effective in their goals, the system must ensure old and new passwords have significant differences. Without significant changes, new passwords may be easily guessed based on the value of a previously compromised password.

Check Content

Check /etc/default/passwd to verify the MINDIFF setting.

# grep ^MINDIFF /etc/default/passwd

If the setting is not present, or is less than 8, this is a finding.

Fix Text

The root role is required.

# pfedit /etc/default/passwd 

Search for MINDIFF. Change the line to read:

MINDIFF=8