The /etc/security/opasswd file stores the users old passwords and can be checked to ensure that users are not recycling recent passwords. Rationale: Forcing users not to reuse their past 5 passwords make it less likely that an attacker will be able to guess the password. Note that these change only apply to accounts configured on the local system. Fix: Set the pam_pwhistory.so remember parameter to 5 in /etc/pam.d/common-password: password required pam_pwhistory.so remember=5 Note: The default password setting in this document is the last 5 passwords. Change this number to conform to your sites password policy.

[number of last passwords to remember]

Set the pam_unix.so remember parameter to 5 in /etc/pam.d/common-password: password sufficient pam_unix.so remember=5 Note: The default password setting in this document is the last 5 passwords. Change this number to conform to your sites password policy.