Password History¶

Without history, a user whose password expires can set it right back to the old one. On Linux the history lives in /etc/security/opasswd and is enforced by a remember= option in /etc/pam.d/common-password.

The value¶

remember= between 10 and 24; use 24, the same as Windows.

Apply¶

Mint and Debian ship the pam_pwhistory module (CIS 5.2.2.4). Enable it the durable way, as a pam-auth-update profile:

sudo tee /usr/share/pam-configs/pwhistory > /dev/null <<'EOF'
Name: pwhistory password history checking
Default: yes
Priority: 1024
Password-Type: Primary
Password:
        requisite                       pam_pwhistory.so remember=24 enforce_for_root use_authtok
EOF
sudo pam-auth-update --enable pwhistory

That writes this line into /etc/pam.d/common-password above pam_unix.so:

password    requisite    pam_pwhistory.so remember=24 enforce_for_root use_authtok

remember=24 is the history depth (CIS 5.2.3.3.1), enforce_for_root applies it to root too (5.2.3.3.2), and use_authtok passes the already-checked password along instead of prompting again (5.2.3.3.3).

Older guides put remember=24 on the pam_unix.so line itself. That works on old systems but the benchmark now says the opposite (5.2.3.4.2): remember= belongs on pam_pwhistory only. If an image has it on pam_unix, move it.

sudo touch /etc/security/opasswd && sudo chmod 600 /etc/security/opasswd

The history file must exist and be root-only, or the module logs an error and lets the reuse through.

Order matters¶

common-password is read top to bottom. Quality (pam_pwquality) checks first, history (pam_pwhistory) second, then pam_unix stores the hash. A history line placed after pam_unix runs after the password has already been changed.

Verify¶

grep -nE 'pwquality|pwhistory|pam_unix' /etc/pam.d/common-password

Three lines in that order, with remember=24 on the history line. Then change a test user's password and try to change it back; the second change is refused with "Password has been already used."

Example¶

grep remember /etc/pam.d/common-password prints nothing. Add the pam_pwhistory line above pam_unix, create opasswd. Verify with a test account: sudo passwd testuser, set A, set B, set A again, refused.

Try it¶

Enable the profile, set a test user's password twice, then try to set the first one again.
Read /etc/pam.d/common-password and explain each line to a partner.

Build it¶

Add the pwhistory profile creation and pam-auth-update --enable to a pam.sh, with the output of grep -n pam_ /etc/pam.d/common-password at the end.

Next¶

Lockout with faillock