Detections
Analytics

4.4.1.2.1 Ensure pam_unix does not include nullok

Information

The nullok argument overrides the default action of pam_unix.so to prevent users from gaining access to a service if their official password is blank.

A strong password is essential to help protect personal and sensitive information from unauthorized access.

Solution

Run the following script to verify that the system and password files don't include the nullok option on the pam_unix.so module:

# grep -E -- '^\s*(auth|account|password|session)\s+(requisite|required|sufficient)\s+pam_unix\.so\b' /etc/pam.d/{passwd,system} | grep -E -- '\bnullok\b'

Example output:

/etc/pam.d/passwd:password required pam_unix.so no_warn try_first_pass nullok
/etc/pam.d/system:auth required pam_unix.so no_warn try_first_pass nullok

- IF - any line is returned with nullok, run the following script:

# find /etc/pam.d -type f -exec sed -i '' -E 's|[[:space:]]?nullok||g' {} \;

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 292e727c59ab31015859533d3b8cb61059803763c769f5dba41a86e25aad9716