Detections
Analytics

5.1.23 Ensure sshd UsePAM is enabled

Information

The UsePAM directive enables the Pluggable Authentication Module (PAM) interface. If set to yes this will enable PAM authentication using ChallengeResponseAuthentication and PasswordAuthentication directives in addition to PAM account and session module processing for all authentication types.

When UsePAM is set to yes, PAM runs through account and session types properly. This is important if you want to restrict access to services based off of IP, time or other factors of the account. Additionally, you can make sure users inherit certain environment variables on login or disallow access to the server

Solution

Edit the /etc/ssh/sshd_config file to set the UsePAM parameter to yes above any Include entries as follows:

UsePAM yes

Impact:

Enabling UsePAM (the platform default) has no adverse operational impact on a standard configuration. UsePAM must remain enabled for PAM-based account and session processing - including access restrictions, resource limits, and session setup - to take effect; disabling it is not supported on this platform.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 08755a20a1e908bfd1c16518741d7af5a45838b7bb62bb92a60dcea3b7cfba69