Detections
Analytics

5.3.2.3.3 Ensure pam_pwhistory includes use_authtok

Information

use_authtok - When password changing enforce the module to set the new password to the one provided by a previously stacked password module

use_authtok allows multiple pam modules to confirm a new password before it is accepted.

Solution

Run the following command to add the use_authtok option to the password stack's pam_pwhistory.so module lines:

# pam-config -a --pwhistory --pwhistory-use_authtok

See Also

https://workbench.cisecurity.org/benchmarks/26236

Item Details

Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-28, 800-53|SC-28(1), CSCv7|16.4

Plugin: Unix

Control ID: 309ddc9542b69d387848140e6102d2733a116361f6f0bc5f5c79a767d674f657