Detections
Analytics

5.3.3.4.1 Ensure pam_unix does not include nullok

Information

The nullok argument overrides the default action of pam_unix.so to not permit the user access to a service if their official password is blank.

The nullok argument permits authentication for a local account that has a blank or empty password, allowing access to a pam_unix backed service with no password. Removing nullok ensures every account must present a real password to authenticate.

Solution

without-nullok is provided as an authselect feature, so it is enabled on the active profile directly and does not require a custom profile (see the section overview for the authselect profile model).

Enable the feature on the active profile:

# authselect enable-feature without-nullok

Apply the change so that /etc/pam.d/system-auth and /etc/pam.d/password-auth are regenerated without the nullok argument:

# authselect apply-changes

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-6b., 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 2520186c49b81d54322687e84223628c46ca067f325c79cbfa684d96bc786b3b