documentation_complete: true

title: 'Limit Password Reuse'

description: |-
    Do not allow users to reuse recent passwords. This can be
    accomplished by using the <tt>remember</tt> option for the <tt>pam_unix</tt>
    or <tt>pam_pwhistory</tt> PAM modules. In the file
    <tt>/etc/pam.d/system-auth</tt>, append <tt>remember=<sub idref="var_password_pam_unix_remember" /></tt>
    to the line which refers to the <tt>pam_unix.so</tt> or
    <tt>pam_pwhistory.so</tt>module, as shown below:
    <ul>
    <li>for the <tt>pam_unix.so</tt> case:
    <pre>password sufficient pam_unix.so <i>existing_options</i> remember=<sub idref="var_password_pam_unix_remember" /></pre>
    </li>
    <li>for the <tt>pam_pwhistory.so</tt> case:
    <pre>password requisite pam_pwhistory.so <i>existing_options</i> remember=<sub idref="var_password_pam_unix_remember" /></pre>
    </li>
    </ul>
    The DoD STIG requirement is 5 passwords.

rationale: 'Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.'

severity: medium

identifiers:
    cce: 26741-9

references:
    disa: 200
    nist: IA-5(f),IA-5(1)(e)
    pcidss: Req-8.2.5
    srg: SRG-OS-000077
    stigid: RHEL-06-000274

ocil_clause: 'it does not'

ocil: |-
    To verify the password reuse setting is compliant, run the following command:
    <pre>$ grep remember /etc/pam.d/system-auth</pre>
    The output should show the following at the end of the line:
    <pre>remember=<sub idref="var_password_pam_unix_remember" /></pre>
