# Ensure password history is enforced for the root user

Necessity: Enforcing password history prevents users, including the root user, from reusing old passwords. This is a critical security control that mitigates the risk of an attacker reusing a previously compromised password to gain access to an account, especially after a forced password reset. For the root account, this is paramount, as its compromise grants complete control over the system. Without this control, an attacker who obtains an old password dump could potentially reuse credentials indefinitely.

Auditing and Remediation: The audit script verifies the system's PAM configuration by reading the `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth` files to determine the value of the 'remember' parameter for the `pam_pwhistory.so` module. The remediation script modifies these same files to set the password history depth to the desired value, ensuring the system enforces the policy.

Recommended State Rationale:
- Basic: A value of `[5, 5]` is recommended by CIS Benchmarks (Level 1) as a minimum standard. It provides a basic safeguard against immediate password reuse.
- Moderate: A value of `[10, 10]` offers a stronger defense, making it significantly more difficult for a user or attacker to cycle through passwords to reuse a preferred or compromised one. This is suitable for most enterprise environments.
- Strict: A value of `[24, 24]` provides a very high level of security, aligning with standards seen in environments like Microsoft Active Directory. It makes password reuse highly impractical and is recommended for systems handling sensitive data or requiring the highest level of security for administrative accounts like root.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[5, 24]` |
| **Moderate** | `[12, 24]` |
| **Strict** | `[24, 24]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that inspects the `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth` files. The script must find the line containing `pam_pwhistory.so` within the `password` stack and extract the numerical value of the `remember` parameter. The script must output only this numerical value. If the parameter is not set or the line does not exist, the script must output `0`.

## Remediation Script Working

Bash script that accepts a single numerical value as a command-line argument. The script must configure the `pam_pwhistory.so` module in both `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth` by adding or updating the `remember` parameter to the provided value on the line containing `pam_pwhistory.so`. It must return `true` on successful configuration and `false` on failure.

