On Thu, Oct 14, 2010 at 10:16:12AM -0400, Brad Tilley wrote:
quoted text
> Stuart VanZee wrote:
> > For 8.5.12 see login.conf man page, look for passwordcheck.
> > You will have to write (or find) a program that keeps track
> > of previously used passwords.  I just stored a hash of them
> > in a file and have it check to see if the new password hash
> > matches any of the old 4 password hashes.
> 
> I considered that as a possible solution as well, but it seems that
> approach would weaken the security of the passwords, especially if you
> just use an unsalted hash (md5 or sah1) to store them.

You could use blowfish to store them; the code already exists
in the openbsd base. Storing multiple previous passwords has
always seemed gratuitous to me, but we're not discussing technical
merits, just technical solutions to management fiats...

quoted text
> 
> Brad