Detections
Analytics
5.3.3.3.1 Ensure password history remember is configured
Information
The /etc/security/opasswd file stores users' old passwords and can be checked to ensure that users are not recycling recent passwords. The number of passwords remembered is set by the remember argument of the pam_pwhistory module.- remember=<N> - <N> is the number of old passwords to remember
Remembering a number of previously used passwords and checking new passwords against them prevents users from cycling back to a recently used - and possibly compromised or expired - password. This defeats password reuse and makes it less likely that an attacker can reuse or guess a password the account has used before.
Solution
Edit or add the following line in /etc/security/pwhistory.conf :remember = 24
Run the following script to remove the remember argument from the pam_pwhistory.so module in /etc/pam.d/system-auth and /etc/pam.d/password-auth :
#!/usr/bin/env bash
{
for l_pam_file in system-auth password-auth; do
l_authselect_file="/etc/authselect/$(head -1 /etc/authselect/authselect.conf | grep 'custom/')/$l_pam_file"
sed -ri 's/(^\s*password\s+(requisite|required|sufficient)\s+pam_pwhistory\.so.*)(\s+remember\s*=\s*\S+)(.*$)/\1\4/' "$l_authselect_file"
done
authselect apply-changes
}
See Also
Item Details
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1), CSCv7|4.4
Plugin: Unix
Control ID: 015783e9cc2bbb3f9021b0dd9c9646196f6e994f6ec0970d6059bbef95e2ac7d