Detections
Analytics

5.3.2.5 Ensure pam_unix module is enabled

Information

The pam_unix.so module is the standard Unix authentication module. It uses standard calls from the system's libraries to retrieve and set account information as well as authentication. Usually this is obtained from the /etc/passwd and the /etc/shadow file as well if shadow is enabled.

Requiring users to use authentication make it less likely that an attacker will be able to access the system.

Solution

pam_unix is part of the default authselect profiles, so a system using a default profile already provides it.

On a system already managed by an authselect profile, ensure the active profile includes pam_unix:

 - The default profiles include it; no change is required.
 - If a custom profile has removed it, restore its auth, account, password, and session pam_unix.so entries to the custom profile's system-auth and password-auth templates in /etc/authselect/custom/<profile>/ (copy them from the corresponding default profile under /usr/share/authselect/default/<profile>/ ).

Then apply the configuration:

# authselect apply-changes

If the system is not yet managed by authselect, or authselect check reports the configuration is not valid, first establish or restore the profile as described in the section overview.

Note: pam_unix is a base-profile module - there is no with-unix feature to enable (unlike with-faillock and with-pwhistory ).

Impact:

pam_unix is included in the default authselect profiles and provides standard local password authentication, so ensuring the active profile includes it has no adverse operational impact on a default configuration.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1)

Plugin: Unix

Control ID: bd772244c7ff4d68a64165d6e9612d6e3f38a7b3f7f91f91ffc152e4fdd68dec