Ensure That Old Passwords Are Verified When Users Change Them

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

# ------------------------------------------------------------------
# METADATA
# ------------------------------------------------------------------

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.130406");
  script_version("2026-01-14T05:47:41+0000");
  script_tag(name:"last_modification", value:"2026-01-14 05:47:41 +0000 (Wed, 14 Jan 2026)");
  script_tag(name:"creation_date", value:"2025-05-07 11:45:55 +0000 (Wed, 07 May 2025)");
  script_tag(name:"cvss_base", value:"0.0");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:H/Au:S/C:N/I:N/A:N");
  script_tag(name:"qod", value:"97");

  script_name("Ensure That Old Passwords Are Verified When Users Change Them");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Policy");
  script_dependencies("compliance_tests.nasl", "compliance_os_check.nasl");

  script_mandatory_keys("Compliance/Launch", "policy/ssh/login/euleros_eulerosvirtual_openeuler");

  script_xref(name:"Policy", value:"EulerOS Baseline: openEuler Security Configuration Baseline (v1.0.0): 2. Secure Access: 2.2 Passwords: 2.2.3 Ensure That Old Passwords Are Verified When Users Change Them (Requirement)");
  script_xref(name:"Policy", value:"EulerOS Virtual: openEuler Security Configuration Baseline (v1.0.0): 2. Secure Access: 2.2 Passwords: 2.2.3 Ensure That Old Passwords Are Verified When Users Change Them (Requirement)");
  script_xref(name:"Policy", value:"openEuler Baseline: openEuler Security Configuration Baseline (v1.0.0): 2. Secure Access: 2.2 Passwords: 2.2.3 Ensure That Old Passwords Are Verified When Users Change Them (Requirement)");

  script_tag(name:"summary", value:"To prevent a third party from maliciously changing the password
of another user, the old password must be verified when a user changes the password.

According to the common practice in the industry, the old password does not need to be verified
when the root user changes its own password. The root user can directly modify the /etc/passwd and
/etc/shadow files. Verifying the old password when changing the password does not improve security.
Therefore, according to the common practice in the industry, the old password does not need to be
verified when the root user changes the password. The owner of a common user can set a new password
only after the old password is verified. Otherwise, security risks may occur. For example, if the
owner leaves the seat without locking the screen after logging in to the system, nearby attackers
can change the password of the common user on the endpoint.

This rule is supported by the pam_unix module by default and no additional configuration is
required.");

  exit(0);
}

include("ssh_func.inc");
include("host_details.inc");
include("policy_reporting_module.inc");

title = "Ensure That Old Passwords Are Verified When Users Change Them";

solution = "This rule is supported by the pam_unix module by default and no configuration is
required.";

check_type = "SSH_Cmd";

action = 'Run the command in the terminal:
# grep -E "password\\s*sufficient\\s*pam_unix.so" /etc/pam.d/system-auth /etc/pam.d/password-auth 2>/dev/null';

expected_value = 'The output should not be empty';

# ------------------------------------------------------------------
# CONNECTION CHECK
# ------------------------------------------------------------------

if(!get_kb_item("login/SSH/success") || !sock = ssh_login_or_reuse_connection()){

  report_ssh_error(title: title,
                   solution: solution,
                   action: action,
                   expected_value: expected_value,
                   check_type: check_type);
  exit(0);
}

# ------------------------------------------------------------------
# CHECK : Check the pam file
# ------------------------------------------------------------------

step_cmd = 'grep -E "password\\s*sufficient\\s*pam_unix.so" /etc/pam.d/system-auth /etc/pam.d/password-auth 2>/dev/null';
actual_value = ssh_cmd(socket:sock, cmd:step_cmd, return_errors:TRUE, return_linux_errors_only:TRUE);

if(eregmatch(string: actual_value, pattern:"(No such file or directory|Permission denied|Command not found|Segmentation fault|service not found|is not running|syntax error near unexpected token|syntax error: unexpected end of file)", icase: TRUE)){
  compliant = "incomplete";
  comment = "Something went wrong during the audit check. Please try again.";
}else if(actual_value){
  compliant = "yes";
  comment = "Check passed";
}else{
  compliant = "no";
  comment = "Check failed";
}

# ------------------------------------------------------------------
# REPORT
# ------------------------------------------------------------------

target = get_kb_item("policy/ssh/login/os-release");
comment = "Target: " + target + "\n" + comment;

report_audit(action: action,
             actual_value: actual_value,
             expected_value: expected_value,
             is_compliant: compliant,
             solution: solution,
             check_type: check_type,
             title: title,
             comment: comment);

exit(0);