Detections
Analytics

5.3.2.1 Ensure PAM is managed by an active authselect profile

Information

authselect renders and manages the system's PAM configuration from a single active profile. When PAM is managed by authselect, the effective /etc/pam.d/system-auth and /etc/pam.d/password-auth files are generated from that profile and their consistency can be verified, providing one supported, reproducible source of truth for authentication configuration.

A custom profile is required to customize many of the pam options.

Modifications made to a default profile may be overwritten during an update.

When you deploy a profile, the profile is applied to every user logging into the given host

Solution

Configure the system to manage PAM through an authselect profile.

Select an authselect profile (a default profile such as sssd, or a custom profile) and apply it:

# authselect select sssd
# authselect apply-changes

Use # authselect select <profile> --force if existing files must be overwritten (for example, on a system not previously managed by authselect).

If authselect check reports the configuration is not valid, restore a valid configuration as described in the section overview.

Impact:

Converting a system to authselect management regenerates /etc/pam.d/system-auth and /etc/pam.d/password-auth from the active profile, overwriting any manual edits to those files.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5

Plugin: Unix

Control ID: 15950d2940f384afe92dd849ef07112144d30af9095783178a1301921088a24e