Detections
Analytics

5.3.3.3.3 Ensure pam_pwhistory includes use_authtok

Information

use_authtok - When password changing enforce the module to set the new password to the one provided by a previously stacked password module

use_authtok directs pam_pwhistory to use the new password token already supplied by an earlier module in the password stack instead of prompting for it again. This ensures the password actually being set is the one checked against the password history. Without it, the history check may be applied to a different value or skipped, weakening enforcement and allowing a reused password to slip through.

Solution

On an authselect-managed system, use_authtok is a module-line argument and must be present on the pam_pwhistory.so line in the active profile's password stack. Set it in the active custom profile's templates so that it persists across authselect apply-changes.

Edit the active custom profile's system-auth and password-auth templates under /etc/authselect/custom/<profile>/ so that the pam_pwhistory.so line in the password stack includes use_authtok :

password requisite pam_pwhistory.so use_authtok

Apply the changes to regenerate the PAM configuration:

# authselect apply-changes

Note: If the system is not yet using a custom authselect profile, first create one from the active base profile and select it, then edit its templates as above and apply:

> # authselect create-profile <profile> -b <current-base>
> # authselect select custom/<profile> <features>
>

See the section overview for the authselect profile mechanics.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 42b346c08bf6017e803dc9b66d6ce11302836b683371e003bfe40a5686579d45