# Ensure password history remember is configured

Necessity: Enforcing a password history prevents users from reusing old or compromised passwords. When a user is forced to change their password, they might revert to a previous, familiar one. If an old password has been exposed in a data breach, reusing it opens the account to trivial compromise. This setting mitigates the risk of credential reuse and brute-force attacks that leverage known, past passwords.

Auditing and Remediation: The audit script examines the PAM configuration in `/etc/pam.d/common-password` to determine the number of previous passwords the `pam_pwhistory` module is configured to remember. The remediation script modifies this same file, setting the `remember` parameter to the desired value, thereby enforcing the system's password history policy.

Recommended State Rationale:
- Basic ([5, 5]): This is a standard baseline recommended by benchmarks like CIS. It prevents users from immediately cycling back to their most recent passwords, providing a fundamental level of security.
- Moderate ([10, 10]): A value of 10 provides a stronger defense by significantly increasing the difficulty for a user to reuse a memorable or favorite password, encouraging better long-term password hygiene.
- Strict ([24, 24]): This aligns with high-security standards (e.g., NIST recommendations) and is suitable for environments with sensitive data. It makes it practically impossible for users to reuse passwords within a multi-year timeframe, drastically reducing the risk from password reuse attacks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[5, 24]` |
| **Moderate** | `[10, 24]` |
| **Strict** | `[24, 24]` |
| **Type** | `RANGE` |

## Audit Script Working

bash script that inspects `/etc/pam.d/common-password` for the `remember` option within the `pam_pwhistory.so` module configuration. The script must parse the line and output only the numeric value of the `remember` parameter. If the parameter is not set, the script should output '0'.

## Remediation Script Working

bash script that accepts a single positional numeric argument. The script must configure the `remember` option for the `pam_pwhistory.so` module in `/etc/pam.d/common-password`. It should find the line containing `pam_pwhistory.so`, and add or update the `remember` option to match the provided argument. If the line does not exist, it should add it. The script must return `true` upon successful modification and `false` if it fails.

