Detections
Analytics

5.4.2.4.4 Ensure pam_unix includes use_authtok

Information

use_authtok - When password changing enforce the module to set the new password to the one provided by a previously stacked password module

use_authtok allows multiple pam modules to confirm a new password before it is accepted.

Solution

Edit the files /etc/pam.d/system-auth and /etc/pam.d/password-auth:

Edit the following line and add the use_authtok argument:

password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok

See Also

https://workbench.cisecurity.org/benchmarks/25279

Item Details

Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-28, 800-53|SC-28(1), CSCv7|16.4

Plugin: Unix

Control ID: adb360f7c942f1925bc1d75df1f3750cc8fe617cd6f8e79d808c6d1f1d498c79