Detections
Analytics

5.3.3.3.2 Ensure password history is enforced for the root user

Information

If the pwhistory enforce_for_root option is enabled, the module will enforce password history for the root user as well

Requiring users not to reuse their passwords make it less likely that an attacker will be able to guess the password or use a compromised password

Note: These changes only apply to accounts configured on the local system.

Solution

Edit or add the following line in /etc/security/pwhistory.conf :

enforce_for_root

- IF - The pam_pwhistory profile in /usr/share/pam-configs/ has been used to configure pwhistory . Run the following script to remove the enforce_for_root argument from the pam_pwhistory.so line in the Password section:

#!/usr/bin/env bash

{
profiles=$(grep -Rl "pam_pwhistory.so" /usr/share/pam-configs/ || true)
for profile in $profiles; do
 if grep -Pq '\h+pam_pwhistory\.so\h+([^#\n\r]+\h+)?enforce_for_root\b' "$profile"; then
 sed -Ei '/pam_pwhistory\.so/s/\enforce_for_root\b//g' "$profile"
 sed -Ei 's/[[:space:]]+/ /g' "$profile"
 echo "Updated pam profile: $profile"
 pam-auth-update --package < /dev/null
 fi
done
}

Note : The options specified on the pwhistory.so module command line override the values from the pwhistory.conf configuration file. The pwhistory.conf file is the preferred method over configuring pam_pwhistory directly.

See Also

https://workbench.cisecurity.org/benchmarks/24932

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 65df3a7f1f16b8ee109426eefc159c3df153eaaf196e4f149bb5149eb4eae085