Incorrect Module Order in /etc/pam.d/common-password May Cause Password Change Errors

SUSE Linux Enterprise Server 15 all Service Packs

Ordinary users encounter an error message when attempting to change their password.

testuser@SUSE-8452:~> passwd
Changing password for testuser.
Current password:
New password:
Retype new password:
Password has been already used. Choose another.
passwd: Have exhausted maximum number of retries for service
passwd: password unchanged  ------------> getting this error but password changed
testuser@SUSE-8452:~> logout

Adjust the Order of the Configuration Update the sequence of modules in /etc/pam.d/common-password to ensure proper functionality.

* Original Configuration:

password requisite pam_cracklib.so try_first_pass retry=5 dsfok=3 minlen=15 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 reject_username
password optional pam_gnome_keyring.so use_authtok
password required pam_unix.so sha512 use_authtok nullok shadow md5 try_first_pass
password required pam_pwhistory.so remember=6

* Modified Configuration:

password requisite pam_cracklib.so try_first_pass retry=5 dsfok=3 minlen=15 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 reject_username
password required pam_pwhistory.so remember=6
password optional pam_gnome_keyring.so use_authtok
password required pam_unix.so sha512 use_authtok nullok shadow md5 try_first_pass

The pam_pwhistory module is a "check" password module, and the pam_unix module is a "write" password module.

The correct order ensures that the password is checked before it is written.

Therefore, the pam_pwhistory module must be placed before the pam_unix module.