# Ensure password history remember is configured

Necessity: Enforcing a password history prevents users from reusing old or compromised passwords. When a user is forced to change their password, they might be tempted to cycle back to a familiar one. This setting mitigates the risk of an attacker gaining access using a previously stolen password, a common tactic in credential stuffing attacks. Misconfiguration could allow immediate password reuse, nullifying the security benefit of forced password changes. Auditing and Remediation: The audit script inspects the Pluggable Authentication Modules (PAM) configuration files (typically `/etc/pam.d/system-auth` or `/etc/pam.d/password-auth`) to determine the number of previous passwords that are remembered. The remediation script modifies these same files to set the 'remember' parameter for the `pam_pwhistory.so` module to the desired value. Recommended State Rationale: Basic: A value of '[5, 5]' provides a fundamental level of protection, preventing users from immediately reusing their last few passwords. This is a common baseline recommended by security frameworks like CIS Level 1. Moderate: A value of '[12, 12]' offers a stronger defense by significantly extending the memory of old passwords, making it much harder to revert to a favorite password and encouraging better long-term password hygiene. Strict: A value of '[24, 24]' provides the highest level of security, aligning with stringent security standards. This makes it exceptionally difficult for users to reuse passwords over a long period, significantly reducing the risk associated with compromised credentials from past breaches.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[5, 24]` |
| **Moderate** | `[10, 24]` |
| **Strict** | `[24, 24]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script to audit the password history remember setting in the PAM configuration. The script should parse the `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth` files to find the `remember=N` value for the `pam_pwhistory.so` module. The script must output only the numerical value. If the setting is not found, it should output '0'.

## Remediation Script Working

Bash script that takes a single numerical value as a command-line argument. The script must locate the `pam_pwhistory.so` module in the password stack of `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth`, and either modify the existing `remember=N` parameter or add `remember=<value>` if it's not present. It must return 'true' on success and 'false' on failure.

