V-285667

Discussion

Users may attempt to circumvent password policy requirements by repeatedly changing passwords until a previously used password can be reused. Reuse of prior passwords reduces the effectiveness of password changes and may allow compromised credentials to remain useful over extended periods. Maintaining password history reduces the likelihood of users reusing known or previously compromised passwords and increases resistance to credential compromise. The operating system must retain and enforce password history to prevent immediate reuse of prior passwords.

Check Content

Verify Harvester Government enforces password history requirements to prevent reuse of previously used passwords.

1. Access Harvester Government using a privileged account and review the PAM password configuration:

grep "pam_pwhistory.so" /etc/pam.d/common-password

2. Verify the configuration retains a history of at least five previously used passwords and prevents users from reusing those passwords. The output must include:

remember=5

If pam_pwhistory.so is absent from the PAM configuration, the remember parameter is not configured, is commented out, or is configured with a value less than 5, this is a finding.