In this lesson, you will learn how to enforce password history tracking to prevent users from cycling between a small set of insecure, recycled credentials.
Why History Matters
Even with strong password complexity requirements, users often fall into the "password rotation" trap. If a user is forced to change their password every 90 days, they might simply alternate between "Summer2023!" and "Summer2024!" By tracking historical passwords, the system ensures that a new password is not just "complex," but also genuinely unique from the recent past.
Configuring pam_unix
The primary mechanism for this in Linux is the pam_unix.so module, specifically when used in the password stack of your PAM configuration. The module utilizes the remember argument to dictate how many previous passwords the system should store in a local database (usually found in /etc/security/opasswd).
To implement this, you modify your /etc/pam.d/common-password file. Locate the line involving pam_unix.so and append the remember flag:
password sufficient pam_unix.so obscure sha512 use_authtok try_first_pass remember=5
In this example, remember=5 tells the system to store the last five passwords used by the user. If the user attempts to set a new password that matches any of those five, the PAM stack will reject the change, forcing the user to choose something they haven't used recently.
Implementation Nuances
When you enable this, the system creates a hash of the new password and compares it against the entries in /etc/security/opasswd. Because this file contains hashes rather than plain text, it remains secure even if the file permissions are accessed.
It is best practice to combine this with pam_pwquality.so to ensure that you are enforcing both complexity (via minlen, dcredit, etc.) and uniqueness (via pam_unix.so history). By forcing users to both expand their character sets and abandon their old habits, you significantly reduce the efficacy of credential-stuffing and brute-force attacks against your user base.
Key Takeaway: By appending the remember argument to pam_unix.so in your PAM password stack, you programmatically prevent users from recycling old, compromised, or predictable passwords.