mediumaccess-controlverified ✓✓rollback-safe
Ensure password maximum sequential characters is configured
pwquality-maxsequence · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
The maxsequence setting in /etc/security/pwquality.conf must be properly configured.
Rationale
Improper maxsequence configuration could weaken system security controls.
Check → Remediate
Checkcommand
val=$(grep -hE '^[[:space:]]*maxsequence[[:space:]]*=' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf 2>/dev/null | tail -n1 | sed 's/^[^=]*=[[:space:]]*//; s/[[:space:]].*$//')
[ -n "$val" ] || { echo "maxsequence not set"; exit 1; }
if [ "$val" -ge 1 ] 2>/dev/null && [ "$val" -le {{ pam_pwquality_maxsequence }} ] 2>/dev/null; then
echo "maxsequence=$val (1..{{ pam_pwquality_maxsequence }})"; exit 0
fi
echo "maxsequence=$val (not in 1..{{ pam_pwquality_maxsequence }}; 0 disables the check)"; exit 1
- expected_exit:
- 0
Remediateconfig_set_dropin
- dir:
- /etc/security/pwquality.conf.d
- file:
- 50-kensa-maxsequence.conf
- key:
- maxsequence
- value:
- {{ pam_pwquality_maxsequence }}
- separator:
- =
Framework references
CIS
rhel9 5.3.3.2.5rhel10 5.3.2.2.5rhel8 5.3.3.2.5ubuntu22 5.3.3.2.5ubuntu24 5.3.3.2.5
NIST 800-53
IA-5
Live verification
rhel10:fullrhel8:fullrhel9:fullubuntu22:checkubuntu24:check
#pam#password#pwquality