Detections
Analytics
5.3.3.4.2 Ensure pam_unix does not include remember
Information
The remember=n argument saves the last n passwords for each user in /etc/security/opasswd in order to force password change history and keep the user from alternating between the same password too frequently. The MD5 password hash algorithm is used for storing the old passwords. Instead of this option the pam_pwhistory module should be used. The pam_pwhistory module saves the last n passwords for each user in /etc/security/opasswd using the password hash algorithm set on the pam_unix module. This allows for the sha512 hash algorithm to be used.Password history is enforced through the pam_pwhistory module, which records prior passwords using the strong hash configured on pam_unix. The remember argument on pam_unix is the legacy mechanism: it stores prior passwords in /etc/security/opasswd using the weak MD5 hash. It should not be set on pam_unix so that password history relies on the stronger pam_pwhistory implementation.
Solution
The pam_unix arguments are set on the pam_unix.so module lines in the active authselect profile; editing /etc/pam.d/system-auth or /etc/pam.d/password-auth directly is not durable, because authselect regenerates those files (see the section overview for the authselect profile model).Remove the remember argument so password history is handled by pam_pwhistory rather than pam_unix:
-
Ensure the system is using a custom authselect profile. If it is still on a stock profile, create and select one first, as described in the section overview.
-
On the pam_unix.so lines in the active custom profile templates (/etc/authselect/custom/<profile>/system-auth and /etc/authselect/custom/<profile>/password-auth), remove any remember=N argument. A compliant line reads:
password sufficient pam_unix.so yescrypt shadow use_authtok
- Apply the change so that /etc/pam.d/system-auth and /etc/pam.d/password-auth are regenerated without the remember argument:
# authselect apply-changes
See Also
Item Details
Audit Name: CIS AlmaLinux OS 9 v3.0.0 L1 Server
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4
Plugin: Unix
Control ID: 27be85189d060df6e95034f9b16a3f9f15b10d95db8431dbc2280caab1a1cfa9