Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately.

In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include such things as enforcement of password length, complexity, lifetime, history, and proper storage/transmission of passwords.

The first enhancement for this control, which is selected for all (Low/Moderate/High) systems includes this requirement:

The information system, for password-based authentication:


(b) Enforces at least a [Assignment: organization-defined number of changed characters] when new passwords are created;

In most systems, it's pretty easy to find and configure the rules that enforce long and complex passwords which are changed regularly and do not exactly match a certain number of old passwords. But, how do you implement a policy that requires a certain amount of characters to be changed with every new password?

Some systems I'm interested in (feel free to address others):

  • Mac OS X
  • Linux/Unix (Any/all flavors)
  • Cisco IOS
share|improve this question
up vote 1 down vote accepted

The approach I would recommend for enterprises would be to integrate these systems with your directory service, which for most will be Active Directory. This way your password policy is set in a single place and it bring other benefits in managing access control and roles in a single place. You can also then provide single sign-on and two factor authentication.

Guidance on doing this:

For Cisco IOS however TACACS+ or Radias servers are the best place to set policy centrally.

share|improve this answer
So, you're saying integrate all non-Windows systems with AD as much as you can and then solve the issue on Windows? – Iszi Apr 19 '11 at 17:01
Yes that would be the best strategic option IMHO. – Rakkhi Apr 28 '11 at 7:56

It's pretty easy to do with PAM, so that covers Linux/Solaris/FreeBSD at least. Among other things the pam_cracklib module offers that functionality. Its default setting is actually to check for five character changed but can be configured by the difok option.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.