Detections
Analytics

5.3.3.4.4 Ensure pam_unix includes use_authtok

Information

The use_authtok argument tells pam_unix, during a password change, to use the new password token already supplied by an earlier module in the password stack rather than prompting for a new one.

With use_authtok, pam_unix commits the password that was already validated by earlier modules in the password stack, such as the quality and history checks, so the password that passed those checks is the one that is stored. Without use_authtok, pam_unix may prompt for and store a different password, bypassing the preceding validation.

Solution

The pam_unix arguments are set on the pam_unix.so module lines in the active authselect profile; editing /etc/pam.d/system-auth or /etc/pam.d/password-auth directly is not durable, because authselect regenerates those files (see the section overview for the authselect profile model).

Add the use_authtok argument so pam_unix uses the password already validated by the preceding modules:

 -

Ensure the system is using a custom authselect profile. If it is still on a stock profile, create and select one first, as described in the section overview.

 -

On the pam_unix.so line in the password stack of the active custom profile templates (/etc/authselect/custom/<profile>/system-auth and /etc/authselect/custom/<profile>/password-auth), add use_authtok. A compliant line reads:

password sufficient pam_unix.so yescrypt shadow use_authtok

 - Apply the change so that /etc/pam.d/system-auth and /etc/pam.d/password-auth are regenerated with the use_authtok argument:

# authselect apply-changes

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 25290a7092261c1954ea29a54e01b2d1802585f0e6593506a263c179193100dc