How to Prevent Users From Reusing Their Last 10 Passwords

Updated: 28 September 2026 · Applies to: pam_pwhistory (Linux-PAM 1.5 to 1.7) on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13

A password history rule stops users from setting a password they used recently, so an expired password cannot simply be set again. The PAM module pam_pwhistory does this. On CentOS 7 (end of life since June 2024) you edited /etc/pam.d/system-auth by hand; on current systems that file is generated, so use the tools below instead. We tested both methods: a user who changed their password and then tried to set the old one again got Password has been already used. Choose another. on AlmaLinux 9 and 10, Ubuntu 24.04 and Debian 13.

AlmaLinux, Rocky Linux and RHEL (authselect)

1. Check the current authselect profile:

   authselect current

2. Enable the password history feature in that profile:

   authselect enable-feature with-pwhistory

   This adds pam_pwhistory.so to /etc/pam.d/system-auth and /etc/pam.d/password-auth. If the server has no authselect profile yet ("No existing configuration detected"), select one first: authselect select local with-pwhistory on version 10, or authselect select sssd with-pwhistory on version 9. If authselect refuses because the current files were edited by hand, add --force; it saves a backup of the old files first.
3. Set how many old passwords to remember in /etc/security/pwhistory.conf:

   remember = 10

Ubuntu and Debian (pam-auth-update)

On Ubuntu and Debian, /etc/pam.d/common-password is generated by pam-auth-update, which overwrites manual edits when PAM packages change. Add a small profile so the setting survives updates:

1. Create /usr/share/pam-configs/pwhistory:

   Name: Password history (remember the last 10 passwords)
   Default: yes
   Priority: 1024
   Password-Type: Primary
   Password:
   	requisite			pam_pwhistory.so remember=10
   Password-Initial:
   	requisite			pam_pwhistory.so remember=10

   The lines after Password: and Password-Initial: start with a tab.
2. Activate it:

   pam-auth-update --enable pwhistory

3. Check the result. pam_pwhistory must come before pam_unix:

   grep -v '^#' /etc/pam.d/common-password

   In our test it showed password requisite pam_pwhistory.so remember=10 followed by pam_unix.so obscure use_authtok try_first_pass yescrypt.

Test it

Log in as a normal user (not root), change the password with passwd, then try to change it back to the old one. The second change must fail with "Password has been already used". Keep a root session open while you test PAM changes, so a mistake cannot lock you out.

Good to know

• Old password hashes are stored in /etc/security/opasswd. History starts when the rule is enabled; earlier passwords are not known.
• root can still set any password for any user. To enforce the rule for root's own password too, add enforce_for_root to /etc/security/pwhistory.conf.
• Combine the history rule with a minimum length and complexity (pam_pwquality), and use SSH keys for server logins where possible.

Official documentation: pam_pwhistory manual and RHEL 9: configuring user authentication with authselect.