Detections
Analytics

5.3.3.3.2 Ensure password history is enforced for the root user

Information

If the pwhistory enforce_for_root option is enabled, the module will enforce password history for the root user as well

Requiring users not to reuse their passwords make it less likely that an attacker will be able to guess the password or use a compromised password

Note: These changes only apply to accounts configured on the local system.

Solution

Note: The options specified on the pam_pwhistory.so module command line override the values from the pwhistory.conf configuration file. The pwhistory.conf file is the preferred method over configuring pam_pwhistory directly. Additionally, if both methods are used to set the same option, pwhistory may silently ignore one - only one method should be used.

Step 1 - Configure /etc/security/pwhistory.conf (preferred method):

Edit /etc/security/pwhistory.conf and add or set the enforce_for_root option:

enforce_for_root

Step 2 - Reconcile the pam-configs profile (conditional cleanup):

- IF - the pam_pwhistory profile in /usr/share/pam-configs/ has been used to configure pwhistory (i.e. an enforce_for_root argument is present on the pam_pwhistory.so line), remove that argument so the value in pwhistory.conf is the single source of truth. Run the following script:

#!/usr/bin/env bash

{
profiles=$(grep -Rl "pam_pwhistory.so" /usr/share/pam-configs/ || true)
for profile in $profiles; do
 if grep -Pq '\h+pam_pwhistory\.so\h+([^#\n\r]+\h+)?enforce_for_root\b' "$profile"; then
 sed -Ei '/pam_pwhistory\.so/s/\benforce_for_root\b//g' "$profile"
 sed -Ei 's/[[:space:]]+/ /g' "$profile"
 echo "Updated pam profile: $profile"
 pam-auth-update --package < /dev/null
 fi
done
}

Verification:

After applying Step 1 (and Step 2 if applicable), confirm the setting is in effect:

# grep -Pi -- '^\h*enforce_for_root\b' /etc/security/pwhistory.conf
# grep -P -- '\bpam_pwhistory\.so\b' /etc/pam.d/common-password

The first command should return enforce_for_root . The second command should return the pam_pwhistory.so line without an enforce_for_root argument (so the pwhistory.conf value applies).

See Also

https://workbench.cisecurity.org/benchmarks/27798

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 3cbeec1006863ddb7a9a0ec6d604d7e5dc153a01da48c71620c4ee9e15cd81ef