Avoid using remember in pam_unix module
Ensures the remember= argument is not set on pam_unix.so, so password history is left to pam_pwhistory.so and the strong password hash is preserved.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Password history must be enforced by pam_pwhistory.so, not by the remember= argument on pam_unix.so. When pam_unix handles history it writes the old hashes to /etc/security/opasswd using its own (weaker) hashing, undermining the stronger algorithm and rounds used elsewhere. Removing remember= from pam_unix keeps history handling in the module designed for it and preserves a robust hash, making cracking of stored passwords harder.
What Pavois checks
Pavois greps the effective PAM tree under /etc/pam.d/ for active pam_unix.so lines and fails if any carries remember=. Inspecting the resolved stack (with @included files) catches the argument wherever it is actually applied, unlike a check tied to one assumed file.
describe command('grep -RE \'^[^#]*\bpam_unix\\.so\b\' /etc/pam.d/ 2>/dev/null | grep -q \'remember=\' && echo ko || echo ok') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run:
grep -rE '^[^#]*\bpam_unix\.so\b' /etc/pam.d/ | grep 'remember='
Expected: no output, no active pam_unix.so line should contain remember=. Any match indicates the misconfiguration.
Inspect & investigate
Password-change events and history rejections are recorded in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/Fedora). Watch journalctl -t passwd -f while changing a password to see which module enforces history; the old-hash store is /etc/security/opasswd.
Remediation
No automated harden plan ships for this rule, so it must be applied manually: edit the password stack (/etc/pam.d/common-password, or password-auth/system-auth on RHEL/Fedora) and remove the remember= argument from the pam_unix.so line, configuring history on a dedicated pam_pwhistory.so line instead.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | # Remove 'remember=' from pam_unix and use pam_pwhistory instead (see pam-remember-pwhistory-remember). # Manage via: pam-auth-update |
|---|---|
| reason | moving history off pam_unix to pam_pwhistory is a stack change, use pam-auth-update |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Leaving remember= on pam_unix weakens stored-hash protection but does not block logins; the fix is low-risk if password history is also configured on pam_pwhistory.so so the policy is not lost. Precautions: keep a root shell open, edit via pam-auth-update/authselect where possible, and verify a password change still works (and still rejects reuse) from a second session before closing your current one.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.3.3.4.2 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.