download g. prohibit password reuse for 24 generations

The remainder of this article provides guidance for the Identification and Authorization (IA) domain.

System and Communications Protection (SC).

of Defense (DoD).ĬMMC Level 2 has 13 domains that have one or more practices related to identity. To complete other configurations or processes to be compliant with CMMC V2.0 level 2requirements, is the responsibility of companies performing work with, and on behalf of, the US Dept. Password required pam_pwhistory.Azure Active Directory helps you meet identity-related practice requirements in each Cybersecurity Maturity Model Certification (CMMC) level. If the line containing 'pam_pwhistory.so' does not have the 'remember' module argument set, is commented out, or the value of the 'remember' module argument is set to less than '5', this is a finding.Ĭonfigure the operating system to prohibit password reuse for a minimum of five generations.Īdd the following line in '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth' (or modify the line to have the required value):

Password required pam_pwhistory.so use_authtok remember=5 retry=3 $ sudo grep -i remember /etc/pam.d/system-auth /etc/pam.d/password-auth Verify the operating system prohibits password reuse for a minimum of five generations.Ĭheck for the value of the 'remember' argument in '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth' with the following command: Red Hat Enterprise Linux 8 Security Technical Implementation Guideĭetails Check Text ( C-33037r567850_chk ) Note that manual changes to the listed files may be overwritten by the 'authselect' program. RHEL 8 utilizes 'pwquality' consecutively as a mechanism to enforce password complexity. If the information system or application allows the user to reuse their password consecutively when that password has exceeded its defined lifetime, the end result is a password that is not changed per policy requirements. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Download g. prohibit password reuse for 24 generations