← All rules
SOCLE-CLD-IAM-027// Accounts (PAM modules)mediumpersistent config

Verify pam_pwhistory module is activated

Ensures pam_pwhistory.so is present in the PAM password stack so the system remembers previous passwords and blocks their reuse.

Checked against the content of a persistent configuration file, the source of truth that survives reboots.

A pass proves? running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 1 standard

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

Enforcing strong, non-recycled passwords increases the difficulty and resources required for password compromise. pam_pwhistory is the module that records old password hashes and rejects a new password matching a recent one; without it, users freely cycle back to a known (possibly leaked) password, defeating the purpose of password expiry.

What Pavois checks

Pavois greps the effective PAM stack under /etc/pam.d/ for an active pam_pwhistory.so line. Because the password stack is assembled from common-password and its @include chain, reading the resolved files catches a module that is present in a sample but removed or commented in the path PAM actually applies, a gap a single-file scan misses.

describe command('grep -RqE \'^[^#]*\bpam_pwhistory\\.so\b\' /etc/pam.d/ 2>/dev/null && echo ok || echo ko') do
  its('stdout.strip') { should eq 'ok' }
end

How to verify it is applied

Run grep -rE '^[^#]*pam_pwhistory\.so' /etc/pam.d/; an active password line should reference the module. As a functional check, try changing a user's password to a value used recently, PAM should reject it ("Password has been already used").

Inspect & investigate

Password-change attempts and rejections are logged in /var/log/auth.log (Debian/Ubuntu). The stored history lives in /etc/security/opasswd.

Remediation

pavois harden apply uses the pam_line resource to insert password required pam_pwhistory.so remember=24 use_authtok enforce_for_root into /etc/pam.d/common-password, placed before the pam_unix.so line so history is checked before the password is committed. It is applied with pavois harden apply.

Pavois applies this with its own harden engine, the plan below, not a shell script:

before^password.*pam_unix\.so
file/etc/pam.d/common-password
linepassword required pam_pwhistory.so remember=24 use_authtok enforce_for_root
modulepam_pwhistory.so
resourcepam_line
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Adding pam_pwhistory only affects password changes, so existing sessions are unaffected, but a malformed password line can break all password changes (users unable to set a new password). Precautions: keep a root session open, test passwd for a throwaway user after applying, and verify the new line sits before pam_unix.so so use_authtok correctly receives the token from the preceding module.

Standards mapping

StandardReferenceTypeVersionConfidence
CIS5.3.2.4directper OS, see the benchmark tablehigh

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references