Enforce Password History with use_authtok
Enforces the use_authtok option on pam_pwhistory.so so it validates the password already provided to the stack instead of prompting again.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The use_authtok option lets pam_pwhistory reuse the new password already collected by an earlier module in the password stack, so multiple modules (quality, history, unix) validate the same token without re-prompting the user. Without it, the modules can fall out of sync and the history check may run against a different value than the one finally stored, weakening enforcement.
What Pavois checks
Pavois greps the effective PAM stack under /etc/pam.d/ for a non-commented pam_pwhistory.so line carrying use_authtok. Reading the resolved password stack (with its @include chain and ordering) rather than a single file is essential here, because use_authtok only works correctly relative to the modules placed before it.
describe command('grep -RqE \'^[^#]*\bpam_pwhistory\\.so\b[^#]*\buse_authtok\' /etc/pam.d/ 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -rE '^[^#]*pam_pwhistory\.so' /etc/pam.d/ and confirm the password line includes use_authtok. Functionally, a single passwd run should prompt for the new password only once and still enforce the history check.
Inspect & investigate
Password-change events are logged in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/Fedora). The history of previous hashes is kept in /etc/security/opasswd.
Remediation
pavois harden apply uses the pam_line resource to ensure the pam_pwhistory.so line in /etc/pam.d/common-password carries use_authtok (with remember=24 and enforce_for_root), inserted before pam_unix.so so it receives the token from the preceding module. It is applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| before | ^password.*pam_unix\.so |
|---|---|
| file | /etc/pam.d/common-password |
| line | password required pam_pwhistory.so remember=24 use_authtok enforce_for_root |
| module | pam_pwhistory.so |
| resource | pam_line |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If use_authtok is set but no earlier module in the stack actually supplies the token, password changes can fail with "authentication token manipulation error". Precautions: keep a root session open, make sure a password-collecting module (e.g. pam_pwquality or pam_unix) precedes pam_pwhistory, and test passwd on a throwaway user before relying on it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.3.3.3.3 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.