# Ensure pam_pwhistory module is enabled

Necessity: The 'pam_pwhistory' module is crucial for enforcing password history, which prevents users from reusing old passwords. This mitigates the risk of an attacker reusing a previously compromised password to gain access to an account after a password change. Without this module, users can cycle through a small set of familiar passwords, significantly weakening the security posture of the system. Enforcing a password history forces the creation of new, unique passwords, increasing overall account security.\n\nAuditing and Remediation: The audit script checks the system's PAM configuration by querying the 'pam-auth-update' utility to determine if the 'pwhistory' profile is active. The remediation script directly modifies this configuration by calling 'pam-auth-update' with the '--enable' or '--disable' flags, thereby activating or deactivating the password history enforcement mechanism across the system for services that use the common PAM stack.\n\nRecommended State Rationale: Basic: ['Enabled'] - Enabling password history is a fundamental security best practice and a common requirement in security benchmarks like CIS. It represents the minimum acceptable state for preventing password reuse. Moderate: ['Enabled'] - As this is a binary setting (either on or off), the only moderately secure state is to have it enabled. Strict: ['Enabled'] - For a strict security policy, the 'pam_pwhistory' module must be enabled. There is no more secure setting than having it active, as it is the core component for enforcing the password history policy defined in files like '/etc/pam.d/common-password'.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'pwhistory' profile is enabled using 'pam-auth-update'. The script must parse the output of 'pam-auth-update --display' to see if 'Password history management' is marked as enabled. The script must return only the string 'Enabled' or 'Disabled' with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must execute 'pam-auth-update --enable pwhistory'. If the argument is 'Disabled', it must execute 'pam-auth-update --disable pwhistory --force'. The script must return the string 'true' upon successful execution or 'false' if the operation fails.

