Changed to pam_pwhistory.so instead of pam_unix.so for remembering old passwords.

Signed-off-by: Farid Joubbi <[email protected]>

Author: joubbi

roles/os_hardening/templates/etc/pam.d/rhel_auth.j2

@@ -33,11 +33,12 @@ account     [default=bad success=ok user_unknown=ignore] pam_sss.so
 account     required      pam_permit.so
 
 {% if (os_auth_pam_passwdqc_enable | bool) %}
-password    required      pam_pwquality.so {{ os_auth_pam_pwquality_options }}
+password    requisite     pam_pwquality.so {{ os_auth_pam_pwquality_options }}
 {% endif %}
-# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
-# NSA 2.3.3.6 Limit Password Reuse
-password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
+{# NSA 2.3.3.6 Limit Password Reuse #}
+password    required      pam_pwhistory.so remember=5 use_authtok
+{# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512 #}
+password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
 {% if (os_auth_pam_sssd_enable | bool) %}
 password    sufficient    pam_sss.so use_authtok
 {% endif %}