Detections
Analytics

1.190 SLES-15-040220

Information

The SUSE operating system must be configured to not overwrite Pluggable Authentication Modules (PAM) configuration on package changes.

GROUP ID: V-235006
RULE ID: SV-235006r991589

The "pam-config" command line utility automatically generates a system PAM configuration as packages are installed, updated, or removed from the system. "pam-config" removes configurations for PAM modules and parameters that it does not know about. It may render ineffective PAM configuration by the system administrator and thus impact system security.

Solution

Copy the PAM configuration files to their static locations and remove the SUSE operating system soft links for the PAM configuration files with the following command:

sudo sh -c 'for X in /etc/pam.d/common-*-pc; do cp -ivp --remove-destination $X ${X:0:-3}; done'

Additional information on the configuration of multifactor authentication on the SUSE operating system can be found at https://www.suse.com/communities/blog/configuring-smart-card-authentication-suse-linux-enterprise/.

See Also

https://workbench.cisecurity.org/benchmarks/23779

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-235006r991589_rule, STIG-ID|SLES-15-040220, Vuln-ID|V-235006

Plugin: Unix

Control ID: 4c12e0150ceb46d5238b180fb9c3c37fec9525c20c8234bce36f4dfa235aca80