andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Changed to pam_pwhistory.so instead of pam_unix.so for remembering old passwords.

Browse Source 
Signed-off-by: Farid Joubbi <[email protected]>
This commit is contained in:
Farid Joubbi committed 2021-03-22 22:28:25 +01:00
1 parent 9614273653
commit 659e5ada6a
1 file changed
+5 -4
Download Patch File Download Diff File Expand all files Collapse all files
roles/os_hardening/templates/etc/pam.d/rhel_auth.j2
+5 -4
View File
@@ -33,11 +33,12 @@ account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
{% if (os_auth_pam_passwdqc_enable | bool) %}
password required pam_pwquality.so {{ os_auth_pam_pwquality_options }}
password requisite pam_pwquality.so {{ os_auth_pam_pwquality_options }}
{% endif %}
# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
# NSA 2.3.3.6 Limit Password Reuse
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
{# NSA 2.3.3.6 Limit Password Reuse #}
password required pam_pwhistory.so remember=5 use_authtok
{# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512 #}
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
{% if (os_auth_pam_sssd_enable | bool) %}
password sufficient pam_sss.so use_authtok
{% endif %}