Ardika Sulistija: Created page with " ====Pam_unix==== pam_unix - Module for traditional password authentication https://linux.die.net/man/8/pam_unix You want to restrict Linux users from using previous 5 passwords when changing the password. As clarified over the chat, this is a system admin task outside of AWS scope of support. To assist you on best-effort basis, I found the link [1] with the steps to do the same. I was able to replicate it in my lab successfully using the following steps for Red Hat..."

2024-09-11T14:19:55Z

Created page with " ====Pam_unix==== pam_unix - Module for traditional password authentication https://linux.die.net/man/8/pam_unix You want to restrict Linux users from using previous 5 passwords when changing the password. As clarified over the chat, this is a system admin task outside of AWS scope of support. To assist you on best-effort basis, I found the link [1] with the steps to do the same. I was able to replicate it in my lab successfully using the following steps for Red Hat..."

New page

====Pam_unix====

pam_unix - Module for traditional password authentication
https://linux.die.net/man/8/pam_unix

You want to restrict Linux users from using previous 5 passwords when changing the password. As clarified over the chat, this is a system admin task outside of AWS scope of support. To assist you on best-effort basis, I found the link [1] with the steps to do the same. I was able to replicate it in my lab successfully using the following steps for Red Hat 7.8

1- Determine if the system is using pam_unix.so or pam_unix2.so files. My instance was using pam_unix.so

# find / -iname "pam_unix.so"
/usr/lib64/security/pam_unix.so

2- Edit /etc/pam.d/system-auth and append remember=5 to the following password line

password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5

3- Set password aging - I skipped this step

4- Create the file /etc/security/opasswd and confirm its permissions:

# [ ! -f /etc/security/opasswd ] && touch /etc/security/opasswd

#ls -lZ /etc/security/opasswd
-rw-------. root root system_u:object_r:shadow_t:s0 /etc/security/opasswd

Then I switched my user to ec2-user and tried to change the password to the current one, and got an error:

$ passwd
Changing password for user ec2-user.
Changing password for ec2-user.
(current) UNIX password:
New password:
BAD PASSWORD: The password is the same as the old one

[1] https://www.cyberciti.biz/tips/how-to-linux-prevent-the-reuse-of-old-passwords.html

====Unable to login via console but you can SSH====
----

I experienced this on RHEL7

If you are able to SSH into your VM over putty but you are unable to login via the console (in hyper-V, for example), you may get the error: FAILED LOGIN SESSION FROM tty1 FOR <user>, Module is unknown.

This issue likely due to the configuration of your /etc/pam.d/login file.

To fix this remove the following line from the /etc/pam.d/login file:
auth required pam_securid.so

Save the file and try again. It fixed the issue for me.

Pam - Revision history