Bug 2228558

Summary:	pam_pwhistory remembers one extra password than specified
Product:	Red Hat Enterprise Linux 7	Reporter:	Chance Callahan <ccallaha>
Component:	pam	Assignee:	Iker Pedrosa <ipedrosa>
Status:	NEW ---	QA Contact:	sssd-qe
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	7.5	CC:	pbrezina
Target Milestone:	rc	Flags:	ipedrosa: needinfo? (ccallaha)
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Chance Callahan 2023-08-02 16:43:36 UTC

Description of problem:

A customer came to us with the following bug: on RHEL 6, if they told pam_pwhistory to remember the last five passwords, it would remember them. If they give the same instruction to the PAM module on RHEL 7.5, it remembers the last six passwords instead of five.

Version-Release number of selected component (if applicable):

* pam-1.1.8-22.el7.x86_64

How reproducible:

I did not personally reproduce it, but the customer has indicated it's affecting multiple systems.

Steps to Reproduce:
1. Enable pam_pwhistory
2. Set it to remember the last five passwords.
3. Change password five times.
4. Try using the original password again.

Actual results:

(per customer) pam_pwhistory remembers the last six passwords instead of the last five.

Expected results:

pam_pwhistory only recalls the last five passwords.

Comment 3 Iker Pedrosa 2023-08-07 10:19:36 UTC

I tried reproducing the error in RHEL7 and it's working as expected. So, I'm wondering, maybe there was a problem in RHEL6 and it was fixed for RHEL7.

Steps:
1- Set 6 different passwords for a user.
2- Change the password to the second one -> Fails because we are reusing a password.
3- Change the password to the first one -> Succeeds.

Can you provide any additional information?

Comment 4 Chance Callahan 2023-08-07 16:25:11 UTC

Did you try on 7.9 or 7.5?

Comment 5 Iker Pedrosa 2023-08-08 06:40:28 UTC

I don't know the exact RHEL version but I know I was using pam-1.1.8-22