# Ensure pam_pwhistory includes use_authtok

Necessity: The `use_authtok` option is critical for the proper functioning of the Pluggable Authentication Modules (PAM) stack during password changes. It instructs the `pam_pwhistory` module to accept the new password from the preceding module (typically `pam_unix`) instead of prompting the user for it again. This ensures a seamless user experience and, more importantly, guarantees that the password history check is performed on the correct, newly-provided password. Misconfiguration (omitting `use_authtok`) can cause the password history policy to be bypassed or fail, significantly weakening account security by allowing users to reuse old passwords.

Auditing and Remediation: The audit script verifies that the PAM configuration in `/etc/pam.d/common-password` correctly includes the `use_authtok` argument on the `pam_pwhistory.so` line. The remediation script programmatically adds or removes this argument to enforce the desired security policy, ensuring the password history module functions correctly within the authentication chain.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Present'. This is a binary, foundational setting. There is no middle ground for its configuration; for the password history policy to be effective, the `use_authtok` option is mandatory. Its absence effectively breaks the password history enforcement mechanism. Therefore, all security hardening levels require this option to be present to ensure the integrity of the password policy.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Present']` |
| **Moderate** | `['Present']` |
| **Strict** | `['Present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the `/etc/pam.d/common-password` file. The script must search for the line containing `pam_pwhistory.so` and determine if the `use_authtok` option is present on that same line. The script should output only the string 'Present' if the option exists and 'Absent' if it does not, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument: 'Present' or 'Absent'. The script will modify the `/etc/pam.d/common-password` file. If the argument is 'Present', it must add the `use_authtok` option to the line containing `pam_pwhistory.so` if it is not already there. If the argument is 'Absent', it must remove the option. The script must return `true` on successful modification or if the state is already correct, and `false` on failure.

