# Ensure pam_pwhistory module is enabled

The 'pam_pwhistory' module is a critical component of a robust password policy, enforcing password history rules to prevent users from reusing old passwords. Necessity: Password reuse is a significant security risk. If a user's password is compromised and they reuse it across different systems or cycle through a small set of favorite passwords, an attacker can easily regain access after a forced password change. By enforcing a password history, the system mitigates this risk by requiring a new, unique password. Auditing and Remediation: The audit script inspects the PAM stack configuration, which on CentOS is typically located in '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth', to verify that the 'pam_pwhistory.so' module is loaded. The remediation script uses the 'authconfig' utility, which is the standard, safe method for modifying the PAM configuration on CentOS, to either enable or disable the module system-wide. Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is 'Enabled' because password history enforcement is a foundational security control with no practical intermediate state; it is either on or off. A Basic security posture requires preventing password reuse. Moderate and Strict postures build upon this by not only enabling the module but also configuring it with more stringent parameters (e.g., remembering more passwords), which are handled by separate configuration settings.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the pam_pwhistory module is enabled in the system's PAM configuration. The script should query the configuration, typically managed by authconfig, and output 'Enabled' if the module is active, or 'Disabled' if it is not. The script must return only the string 'Enabled' or 'Disabled' with no additional text.

## Remediation Script Working

Bash script that accepts one positional argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must execute the 'authconfig --enablepwhistory --update' command. If the argument is 'Disabled', it must execute 'authconfig --disablepwhistory --update'. The script must return 'true' upon successful execution and 'false' if the command fails or the input is invalid.

