Detections
Analytics

5.3.3.3.1 Ensure password history remember is configured

Information

The /etc/security/opasswd file stores the users' old passwords and can be checked to ensure that users are not recycling recent passwords. The number of passwords remembered is set via the remember argument value in set for the pam_pwhistory module.

The pwhistory.conf provides a way to configure the default settings for saving the last passwords for each user. This file is read by the pam_pwhistory module and is the preferred method over configuring pam_pwhistory directly.

 - remember=<N> - The last <N> passwords for each user are saved. The default is 10 . Value of 0 makes the module to keep the existing contents of the opasswd file unchanged.

Requiring users not to reuse their passwords make it less likely that an attacker will be able to guess the password or use a compromised password.

Note: These changes only apply to accounts configured on the local system.

Solution

Note: The options specified on the pam_pwhistory.so module command line override the values from the pwhistory.conf configuration file. The pwhistory.conf file is the preferred method over configuring pam_pwhistory directly. Only one method should be used; if remember=<N> is set in both locations and the values differ, the per-module argument wins and the pwhistory.conf value is silently ignored.

Step 1 - Set the value in pwhistory.conf (preferred method):

Edit /etc/security/pwhistory.conf and add or modify the remember option, setting it to 24 or more depending on local site policy:

remember = 24

Step 2 (conditional) - Reconcile any conflicting pam-configs profile:

If a profile under /usr/share/pam-configs/ sets remember=<N> on the pam_pwhistory.so line and the value differs from what was set in Step 1, the per-module argument will override pwhistory.conf . List the candidate profiles:

# grep -RPl '\bpam_pwhistory\.so\b' /usr/share/pam-configs/

For each profile returned, open the file in a text editor and locate the Password: and Password-Initial: blocks. Remove the remember=<N> argument from the pam_pwhistory.so line in those blocks (leave any other arguments such as enforce_for_root or use_authtok in place).

Re-render /etc/pam.d/common-password from the updated profile by running:

# pam-auth-update --enable <profile-name>

where <profile-name> matches the filename in /usr/share/pam-configs/ (without any path).

Verification:

Confirm that pwhistory.conf carries the intended value and that no conflicting per-module argument remains:

# grep -Pi -- '^\h*remember\h*=\h*\d+\b' /etc/security/pwhistory.conf
# grep -PHs -- '\bpam_pwhistory\.so\b[^#\n\r]*\bremember=' /etc/pam.d/common-password

The first command should return remember = 24 (or your site-policy value). The second command should return no output.

See Also

https://workbench.cisecurity.org/benchmarks/27798

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 04e414438888b1ee733f5c8557b244f79ad7cd8bb1769350f0f8510f2266a761