mediumaccess-controlverified ✓✓rollback-safe

Ensure pam_pwhistory includes use_authtok

pam-pwhistory-use-authtok · RHEL ≥ 8 · 2 impls

Description

The pam_pwhistory module should use the use_authtok option to use the password from the previous PAM module in the stack.

Rationale

The use_authtok option ensures password history checking uses the password that was already validated by earlier PAM modules.

Check → Remediate

Checkcommand

if grep -qE 'pam_pwhistory\.so.*use_authtok' /etc/pam.d/system-auth 2>/dev/null; then
  echo "OK: pam_pwhistory includes use_authtok"
  exit 0
fi
echo "FAIL: pam_pwhistory does not include use_authtok"
exit 1

expected_exit:: 0

Remediateconfig_append

path:: /etc/security/pwhistory.conf
line:: use_authtok

Framework references

CIS

rhel9 5.3.3.3.3rhel10 5.3.2.3.3rhel8 5.3.3.3.3

NIST 800-53

IA-5

Live verification

rhel10:fullrhel8:checkrhel9:check

#pam#password#pwhistory#security