---
title: "HOST-PAM-004 Password History Not Enforced"
canonical: https://openvapt.com/checks/HOST-PAM-004.html
html: https://openvapt.com/checks/HOST-PAM-004.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-PAM-004 Password History Not Enforced

Checks that PAM remembers at least the last 5 passwords so a changed password cannot be changed straight back.

- Domain: Server
- Severity: Low
- Control category: Identity and Authentication
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`
- CIS Controls v8: 5.2
- NIST CSF 2.0: PR.AA-01
- CWE: CWE-262
- OWASP Top 10 2021: A07:2021
- NIST SP 800-53 Rev. 5: IA-5(1)
- Benchmark topic: Password reuse is limited (CIS Controls v8 5.2) (topic only, no benchmark text)

## Why It Matters

When a password must be changed after a suspected compromise, the point is lost if the user can set the old one again. pam_pwhistory (or pam_unix remember=) keeps recent hashes and refuses reuse. Five is a common minimum.

## How It Detects

Reads /etc/pam.d/common-password, /etc/pam.d/system-auth and /etc/pam.d/password-auth for remember=N on a pam_pwhistory or pam_unix line, or remember in /etc/security/pwhistory.conf. N of 5 or more passes. Skipped when no password stack exists; Incomplete when one exists but cannot be read.

## How to Fix

Add  password required pam_pwhistory.so remember=5 use_authtok  before pam_unix in the password stack (pam-auth-update on Debian/Ubuntu, authselect enable-feature with-pwhistory on the RHEL family), or set  remember = 5  in /etc/security/pwhistory.conf. Keep a root session open and test a password change in a second session before closing it: a wrong PAM line can block password changes or logins.

## How to Verify

```
grep -E 'remember' /etc/pam.d/common-password /etc/pam.d/system-auth /etc/security/pwhistory.conf 2>/dev/null
```

## Learn the Theory

- [P22 Authentication Policy and Package Hygiene](https://openvapt.com/academy/p22.md)

## References

- [pam_pwhistory(8), Linux-PAM](https://man7.org/linux/man-pages/man8/pam_pwhistory.8.html)
- [pam_unix(8), Linux-PAM](https://man7.org/linux/man-pages/man8/pam_unix.8.html)
- [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pam_login.go

Run it: `openvapt scan --only HOST-PAM-004`. Read it offline: `openvapt explain HOST-PAM-004`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-PAM-004.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.