# Ensure pam_pwhistory includes use_authtok

Necessity: The `use_authtok` option within the `pam_pwhistory` module is critical for ensuring correct password management workflow. It instructs the module to obtain the new password from a previous module in the PAM stack (like `pam_unix` or `pam_pwquality`) rather than prompting the user for it directly. This ensures that password history is only checked and updated *after* the new password has passed all other quality and complexity checks. Without `use_authtok`, a password that fails a complexity check could still be added to the history, preventing the user from using that valid password later. This misconfiguration leads to user frustration and undermines the effectiveness of password history policies.

Auditing and Remediation: The audit script inspects the PAM configuration files (`/etc/pam.d/system-auth` and `/etc/pam.d/password-auth`) to verify the presence of the `use_authtok` option on the `pam_pwhistory.so` line. The remediation script modifies these files to append the `use_authtok` option if it is absent, thereby correcting the PAM module execution order.

Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is `['present']` because this setting is a functional requirement, not a tunable security parameter. It dictates the correct operational behavior of the PAM stack. Its absence represents a misconfiguration, while its presence ensures the intended interaction between password history and password quality modules. Therefore, there is only one correct state for this setting across all security hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['present']` |
| **Moderate** | `['present']` |
| **Strict** | `['present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks both `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth` files. The script must find the line containing `pam_pwhistory.so` and check if the `use_authtok` option is present on that line. It should return `true` if the option is present in both files, and `false` otherwise. The output must consist solely of the boolean value.

## Remediation Script Working

Bash script that accepts one positional string argument, which will be 'present'. If the argument is 'present', the script must locate the line containing `pam_pwhistory.so` in both `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth` and add the `use_authtok` option if it is not already there. The script should use a tool like `sed` to perform an in-place modification. The script must return `true` upon successful modification or if the setting is already correctly configured, and `false` on any failure.

