Detections
Analytics
5.3.2.4 Ensure pam_pwhistory module is enabled
Information
The pam_pwhistory.so module saves the last passwords for each user in order to force password change history and keep the user from alternating between the same password too frequently.Requiring users not to reuse their passwords make it less likely that an attacker will be able to guess the password or use a compromised password.
Solution
On a system already managed by an authselect profile, run the following commands to enable the pwhistory feature and apply the changes:# authselect enable-feature with-pwhistory
# authselect apply-changes
authselect regenerates /etc/pam.d/system-auth and /etc/pam.d/password-auth with the pam_pwhistory.so lines.
If the system is not yet managed by authselect, or authselect check reports the configuration is not valid, first establish or restore the profile as described in the section overview, then run the commands above.
Impact:
pam_pwhistory prevents reuse of recently used passwords by recording password history. Users may need more effort to choose a new password that has not been used recently, and a larger remembered-history depth increases that effort.
See Also
Item Details
Audit Name: CIS Rocky Linux 9 v3.0.0 L1 Workstation
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1), CSCv7|4.4
Plugin: Unix
Control ID: cd08f4e474287349d50bc9374ebc71ed8e3f9c36ce422700ac4108a904c8a99c