I have an Ubuntu GNOME 15.10 with GNOME 3.18 system which I would like to set up so that the users using it cannot set a new password as one of the previous X passwords, how can this be achieved?
When I change my password, if it is too similar to my last my system does not allow me to change it to that password, it would be good if the answer could also show how to extend this so that the new password can also not be too similar to the previous X recorded passwords.
Note: The history of the last X passwords should not be stored in an insecure unencrypted manner, in fact they should probably be stored in the same or similar way to the way in which the current password is stored (as a salted hash).
I have used
X to represent the number of passwords (this could be any value) because I want to be able to easily change the amount of passwords stored which cannot be used, and also so that others can easily take the answer and use it as they wish rather than having an answer which revolves around a very set value for
As requested here is the contents of my (excluding the comments at the top)
# here are the per-package modules (the "Primary" block) password [success=1 default=ignore] pam_unix.so obscure sha512 # here's the fallback if no module succeeds password requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around password required pam_permit.so # and here are more per-package modules (the "Additional" block) password optional pam_gnome_keyring.so # end of pam-auth-update config