I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately.

In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include such things as enforcement of password length, complexity, lifetime, history, and proper storage/transmission of passwords.

The first enhancement for this control, which is selected for all (Low/Moderate/High) systems includes this requirement:

The information system, for password-based authentication:


(b) Enforces at least a [Assignment: organization-defined number of changed characters] when new passwords are created;

In most systems, it's pretty easy to find and configure the rules that enforce long and complex passwords which are changed regularly and do not exactly match a certain number of old passwords. But, how do you implement a policy that requires a certain amount of characters to be changed with every new password?

Some systems I'm interested in (feel free to address others):

  • Mac OS X
  • Linux/Unix (Any/all flavors)
  • Cisco IOS

2 Answers 2


The approach I would recommend for enterprises would be to integrate these systems with your directory service, which for most will be Active Directory. This way your password policy is set in a single place and it bring other benefits in managing access control and roles in a single place. You can also then provide single sign-on and two factor authentication.

Guidance on doing this:

For Cisco IOS however TACACS+ or Radias servers are the best place to set policy centrally.

  • So, you're saying integrate all non-Windows systems with AD as much as you can and then solve the issue on Windows?
    – Iszi
    Commented Apr 19, 2011 at 17:01
  • Yes that would be the best strategic option IMHO.
    – Rakkhi
    Commented Apr 28, 2011 at 7:56

It's pretty easy to do with PAM, so that covers Linux/Solaris/FreeBSD at least. Among other things the pam_cracklib module offers that functionality. Its default setting is actually to check for five character changed but can be configured by the difok option.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .