Limit Password Reuse: password-auth
An XCCDF Rule
Description
Do not allow users to reuse recent passwords. This can be accomplished by using the
remember option for the pam_pwhistory PAM module.
On systems with newer versions of authselect, the pam_pwhistory PAM module
can be enabled via authselect feature:
authselect enable-feature with-pwhistoryOtherwise, it should be enabled using an authselect custom profile.
Newer systems also have the
/etc/security/pwhistory.conf file for setting
pam_pwhistory module options. This file should be used whenever available.
Otherwise, the pam_pwhistory module options can be set in PAM files.
The value for
remember option must be equal or greater than
warning alert: Warning
If the system relies on
authselect tool to manage PAM settings, the remediation
will also use authselect tool. However, if any manual modification was made in
PAM files, the authselect integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.warning alert: Warning
Newer versions of
authselect contain an authselect feature to easily and properly
enable pam_pwhistory.so module. If this feature is not yet available in your
system, an authselect custom profile must be used to avoid integrity issues in PAM files.
If a custom profile was created and used in the system before this authselect feature was
available, the new feature can't be used with this custom profile and the
remediation will fail. In this case, the custom profile should be recreated or manually
updated.Rationale
Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.
- ID
- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
- Severity
- Medium
- References
- Updated