According to this STIG, password history is entered into /etc/pam.d/system-auth, but not /etc/pam.d/password-auth. Other policies, for example, account lockouts are applied to both files.
Why isn't the password history entered into both, or is this just a typo in the STIG? (Hard to believe that second, but it happens.)
The password-auth and system-auth files are not directly used by any process or service. Instead, they are pulled into other PAM configuration files using the include directive. The only thing that really cares about password history on a default installation is the passwd command. It has its own PAM module, and it only pulls in system-auth:
[root@rhel7 ~]# grep include /etc/pam.d/passwd
auth include system-auth
account include system-auth
Account lockouts are recommended for both because services like sshd pull in password-auth instead. On the RHEL 7 system I'm looking at right now, system-auth is mostly pulled into PAM files for things the user would interact with directly (login, password changes, su and sudo, etc.), while password-auth is pulled in by running daemons like sshd and crond.
You can add the password history setting to pam_unix.so in password-auth for consistency, if you want to. It won't harm anything, but neither will it do anything useful.
sshd/crond don't need it because the history is only ever called when changing the password, which will only be happening at the shell. Does that sound correct?
Commented
Dec 14, 2018 at 22:42
passwd command. It's not limited to just the shell, though, since you could call passwd from a script through non-interactive automation if you wanted to.
Commented
Dec 14, 2018 at 23:04