How to configure PAM to remember password history changes

This document (3829103) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Desktop 10
SUSE Linux Desktop 9

SUSE Linux Enterprise Server 10

SUSE Linux Enterprise Server 9

Situation

Every time a user changes her password, you would like it to be stored in a password history file. Additionally, PAM should check this file so that users can't reuse their previous "N" number of passwords.

Resolution

NOTE: For a newer article on this topic, see TID 7008156, https://www.suse.com/support/kb/doc/?id=7008156

Edit:
/etc/pam.d/password (SLES9, OES/Linux 1, SUSE Linux Desktop 9)
or
/etc/pam.d/common-password (SLE 10, OES/Linux 2)

and change the line:

password required pam_pwcheck.so nullok

password required pam_pwcheck.so nullok remember=N

Put in the number of passwords you want to be saved/checked instead of "N".

Additional Information

The passwords are stored /etc/security/opasswd and checked every time a user changes her password.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.