mediumaccess-controlverified ✓rollback-safe
Limit consecutive repeating characters in password
pam-pwquality-maxrepeat · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
The maxrepeat parameter in /etc/security/pwquality.conf sets the maximum number of allowed consecutive same characters in a password.
Rationale
Limiting consecutive repeating characters prevents weak patterns like "aaaa" or "1111" in passwords, increasing resistance to pattern-based attacks.
Check → Remediate
Checkcommand
val=$(grep -hE '^[[:space:]]*maxrepeat[[:space:]]*=' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf 2>/dev/null | tail -n1 | sed 's/^[^=]*=[[:space:]]*//; s/[[:space:]].*$//')
[ -n "$val" ] || { echo "maxrepeat not set"; exit 1; }
if [ "$val" -ge 1 ] 2>/dev/null && [ "$val" -le {{ pam_pwquality_maxrepeat }} ] 2>/dev/null; then
echo "maxrepeat=$val (1..{{ pam_pwquality_maxrepeat }})"; exit 0
fi
echo "maxrepeat=$val (not in 1..{{ pam_pwquality_maxrepeat }}; 0 disables the check)"; exit 1
- expected_exit:
- 0
Remediateconfig_set_dropin
- dir:
- /etc/security/pwquality.conf.d
- file:
- 50-kensa-maxrepeat.conf
- key:
- maxrepeat
- value:
- {{ pam_pwquality_maxrepeat }}
- separator:
- =
Framework references
CIS
rhel8 5.3.3.2.4rhel9 5.3.3.2.4rhel10 5.3.2.2.4ubuntu22 5.3.3.2.4ubuntu24 5.3.3.2.4
STIG
V-258114 / RHEL-09-611125V-230361V-281188 / RHEL-10-600290
NIST 800-53
IA-5(1)(a)IA-5
Live verification
rhel10:checkrhel8:checkrhel9:checkubuntu22:checkubuntu24:check
#pam#password#authentication#pwquality