Detections
Analytics

5.3.2.4.4 Ensure pam_unix includes use_authtok

Information

use_authtok - When password changing enforce the module to set the new password to the one provided by a previously stacked password module

use_authtok allows multiple pam modules to confirm a new password before it is accepted.

Solution

Edit or create the line use_authtok on the password stack's pam_unix.so module lines:

Example /etc/pam.d/common-password file:

password required pam_unix.so use_authtok shadow sha512

See Also

https://workbench.cisecurity.org/benchmarks/26236

Item Details

Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-28, 800-53|SC-28(1), CSCv7|16.4

Plugin: Unix

Control ID: 6ac9814684a90f656ee1d801b1f29d8f9f56f022aae80f965b283807b8cb1595