# Ensure password history is enforced for the root user

Necessity: Enforcing password history prevents users, including the root user, from reusing old passwords. This is a critical security control that mitigates the risk of an attacker reusing a previously compromised password to gain access. Without password history, a user could cycle between a few favorite passwords, significantly reducing the effectiveness of periodic password change policies and making the system vulnerable to credential stuffing attacks. Misconfiguration could allow for immediate password reuse, nullifying other password complexity and length requirements. Auditing and Remediation: The audit script checks the PAM configuration in `/etc/pam.d/common-password` to determine the value of the `remember` parameter for the `pam_pwhistory` module, which dictates how many unique previous passwords are stored. The remediation script modifies this same file to set or update the `remember` parameter to the desired value, thereby enforcing the password history policy. Recommended State Rationale: Basic [5, 5]: This is a common baseline recommended by frameworks like the CIS Benchmarks (Level 1). It provides a fundamental layer of protection against the most common password reuse habits. Moderate [12, 12]: This offers significantly stronger security by forcing users to create unique passwords for at least a year, assuming monthly changes. This makes it much more difficult to cycle back to a memorable but potentially weak password. Strict [24, 24]: This aligns with high-security standards (e.g., PCI-DSS, STIGs) and provides a very robust defense. A history of 24 passwords makes it nearly impossible for an attacker with a list of historical password hashes to reuse one, and it strongly encourages the creation of truly unique and strong passwords over the long term.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[5, 24]` |
| **Moderate** | `[12, 24]` |
| **Strict** | `[24, 24]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that inspects the `/etc/pam.d/common-password` file. The script must find the line containing `pam_pwhistory.so` and extract the numerical value of the `remember` parameter. If the parameter is not present or the line does not exist, the script should return `0`. The script must output only the numerical value.

## Remediation Script Working

Bash script that accepts a single numerical value as a positional command-line argument. The script should modify the `/etc/pam.d/common-password` file. It must locate the line for `pam_pwhistory.so` and set its `remember` parameter to the provided value. If the line does not exist, the script must add it. The script must output `true` on success and `false` on failure.

