mediumaccess-controlverified ✓

Ensure pam_unix does not include remember

pam-unix-no-remember · RHEL ≥ 8 · 2 impls

Description

The pam_unix module should not include the remember option as password history should be handled by pam_pwhistory instead.

Rationale

Using remember in pam_unix is deprecated. Password history should be managed by pam_pwhistory for proper enforcement and configuration.

Check → Remediate

Checkcommand

if grep -E 'pam_unix\.so.*remember' /etc/pam.d/system-auth /etc/pam.d/password-auth 2>/dev/null | grep -v '^#'; then
  echo "FAIL: remember option found in pam_unix configuration"
  exit 1
fi
echo "OK: pam_unix does not include remember"
exit 0

expected_exit:: 0

Remediatepam_module_arg

action:: remove
module:: pam_unix.so
arg:: remember=[0-9]*
arg_regex:: true
files:: /etc/pam.d/system-auth, /etc/pam.d/password-auth

Framework references

CIS

rhel9 5.3.3.4.2rhel10 5.3.2.4.2rhel8 5.3.3.4.2

NIST 800-53

IA-5

Live verification

rhel10:checkrhel9:check

#pam#password#history#security