documentation_complete: true

prodtype: rhel7,fedora

title: 'Limit Password Reuse'

description: "Do not allow users to reuse recent passwords. This can be\naccomplished by using the <tt>remember</tt> option for the <tt>pam_unix</tt>\nor <tt>pam_pwhistory</tt> PAM modules. \n<br /><br />\nIn the file <tt>/etc/pam.d/system-auth</tt>, append <tt>remember=<sub idref=\"var_password_pam_unix_remember\" /></tt>\nto the line which refers to the <tt>pam_unix.so</tt> or <tt>pam_pwhistory.so</tt>module, as shown below:\n<ul>\n<li>for the <tt>pam_unix.so</tt> case:\n<pre>password sufficient pam_unix.so <i>...existing_options...</i> remember=<sub idref=\"var_password_pam_unix_remember\" /></pre>\n</li>\n<li>for the <tt>pam_pwhistory.so</tt> case:\n<pre>password requisite pam_pwhistory.so <i>...existing_options...</i> remember=<sub idref=\"var_password_pam_unix_remember\" /></pre>\n</li>\n</ul>\nThe DoD STIG requirement is 5 passwords."

rationale: 'Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.'

severity: medium

identifiers:
    cce@rhel7: 26923-3

references:
    cis: 5.3.3
    cjis: 5.6.2.1.1
    cui: 3.5.8
    disa: 200
    nist: IA-5(f),IA-5(1)(e)
    pcidss: Req-8.2.5
    srg: SRG-OS-000077-GPOS-00045
    stigid@rhel7: "010270"

ocil_clause: 'the value of remember is not set equal to or greater than the expected setting'

ocil: |-
    To verify the password reuse setting is compliant, run the following command:
    <pre>$ grep remember /etc/pam.d/system-auth</pre>
    The output should show the following at the end of the line:
    <pre>remember=<sub idref="var_password_pam_unix_remember" /></pre>
