Limit Password Reuse
Enforces the enforce_for_root option on pam_pwhistory.so so the password-reuse restriction applies to every account, including root.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Preventing reuse of previous passwords helps ensure that a compromised password is not silently reinstated by a user. pam_pwhistory exempts root by default, leaving a hole for the most powerful account; enforce_for_root makes the reuse policy universal so password history is genuinely enforced across the system.
What Pavois checks
Pavois greps the effective PAM stack under /etc/pam.d/ for a non-commented pam_pwhistory.so line carrying enforce_for_root. Resolving the assembled password stack (its common-password plus @include chain) instead of one file prevents a false pass where the flag is in a sample but not in the rule PAM actually applies.
describe command('grep -RqE \'^[^#]*\bpam_pwhistory\.so\' /etc/pam.d/ 2>/dev/null && { grep -RqE \'^[^#]*\bpam_pwhistory\.so[^#]*\benforce_for_root\' /etc/pam.d/ 2>/dev/null || grep -qE \'^[[:space:]]*enforce_for_root\b\' /etc/security/pwhistory.conf 2>/dev/null; } && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -rE '^[^#]*pam_pwhistory\.so' /etc/pam.d/ and confirm the password line includes enforce_for_root. Functionally, try setting a recently used password with passwd (as a normal user and as root), both should be rejected.
Inspect & investigate
Password-change attempts and reuse rejections are logged in /var/log/auth.log (Debian/Ubuntu). The stored history lives in /etc/security/opasswd.
Remediation
pavois harden apply uses the pam_line resource to ensure /etc/pam.d/common-password contains password required pam_pwhistory.so remember=24 use_authtok enforce_for_root, inserted before the pam_unix.so line. It is applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| before | ^password.*pam_unix\.so |
|---|---|
| file | /etc/pam.d/common-password |
| line | password required pam_pwhistory.so remember=24 use_authtok enforce_for_root |
| module | pam_pwhistory.so |
| resource | pam_line |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
This only restricts password changes and does not affect logins or live sessions. The main risk is a malformed password line that blocks all password changes, or root being unable to reset a password to a value it had just retired. Precautions: keep a root session open, test passwd on a throwaway user after applying, and confirm the line precedes pam_unix.so so use_authtok works.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.3.3.3.2 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.