Package: libpam-modules Version: 1.1.8-3.6 Severity: important Dear Maintainer,
I enabled password history by adding the following line in /etc/pam.d/common-password: password requisite pam_pwhistory.so debug remember=10 --> I added password [success=1 default=ignore] pam_unix.so debug obscure sha512 Note that I added the debug arg for pam_unix. Now I add user test with password testuser1. I change its password to testuser2. I can see the file /etc/security/opasswd is updated. I then try to change the password back to testuser1 and I see a warning saying 'Password has already been used' but it proceeds to change the password back to testuser1. I tried the same scenarion on Debian Wheezy and I get the expected error/result saying password could not changed since it exists in its history. Logs on Debian Stretch: Dec 10 11:43:22 debian9 chpasswd[12268]: pam_pwhistory(chpasswd:chauthtok): pam_sm_chauthtok entered Dec 10 11:43:22 debian9 chpasswd[12268]: pam_pwhistory(chpasswd:chauthtok): pam_sm_chauthtok(PAM_PRELIM_CHECK) Dec 10 11:43:22 debian9 chpasswd[12268]: pam_unix(chpasswd:chauthtok): username [test] obtained Dec 10 11:43:22 debian9 chpasswd[12268]: pam_pwhistory(chpasswd:chauthtok): pam_sm_chauthtok entered Dec 10 11:43:22 debian9 chpasswd[12268]: pam_pwhistory(chpasswd:chauthtok): got new auth token Dec 10 11:43:22 debian9 chpasswd[12268]: pam_pwhistory(chpasswd:chauthtok): check against old password file Dec 10 11:43:22 debian9 chpasswd[12268]: pam_pwhistory(chpasswd:chauthtok): New password already used Dec 10 11:43:22 debian9 chpasswd[12268]: pam_unix(chpasswd:chauthtok): username [test] obtained Dec 10 11:43:22 debian9 chpasswd[12268]: pam_unix(chpasswd:chauthtok): password changed for test Dec 10 11:43:22 debian9 chpasswd[12268]: gkr-pam: couldn't update the login keyring password: no old password was entered Logs on Debian Wheezy: Dec 10 11:47:59 protegrity-esa150 chpasswd[46796]: pam_pwhistory(chpasswd:chauthtok): pam_sm_chauthtok entered Dec 10 11:47:59 protegrity-esa150 chpasswd[46796]: pam_pwhistory(chpasswd:chauthtok): pam_sm_chauthtok(PAM_PRELIM_CHECK) Dec 10 11:47:59 protegrity-esa150 chpasswd[46796]: pam_unix(chpasswd:chauthtok): username [test] obtained Dec 10 11:47:59 protegrity-esa150 chpasswd[46796]: pam_pwhistory(chpasswd:chauthtok): pam_sm_chauthtok entered Dec 10 11:47:59 protegrity-esa150 chpasswd[46796]: pam_pwhistory(chpasswd:chauthtok): got new auth token Dec 10 11:47:59 protegrity-esa150 chpasswd[46796]: pam_pwhistory(chpasswd:chauthtok): check against old password file Dec 10 11:47:59 protegrity-esa150 chpasswd[46796]: pam_pwhistory(chpasswd:chauthtok): New password already used Dec 10 11:47:59 protegrity-esa150 chpasswd[46796]: pam_pwhistory(chpasswd:chauthtok): Aborted, too many tries -- System Information: Debian Release: 9.5 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.9.0-8-amd64 (SMP w/4 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Init: systemd (via /run/systemd/system) Versions of packages libpam-modules depends on: ii debconf [debconf-2.0] 1.5.61 ii libaudit1 1:2.6.7-2 ii libc6 2.24-11+deb9u3 ii libdb5.3 5.3.28-12+deb9u1 ii libpam-modules-bin 1.1.8-3.6 ii libpam0g 1.1.8-3.6 ii libselinux1 2.6-3+b3 libpam-modules recommends no packages. libpam-modules suggests no packages. -- debconf information excluded
