Skip to content
ATO Pathways
  Log In

Configure PAMs passwd Module To Implement system-auth Substack When Changing Passwords

An XCCDF Rule

Description

Verify that pam is configured to use /etc/pam.d/system-auth when changing passwords. Look for the following line in /etc/pam.d/passwd: 

password substack system-auth

Rationale

Including system-auth from the passwd module ensures that the user must pass through the PAM configuration for system authentication as found in /etc/pam.d/system-auth when changing passwords.

ID
xccdf_org.ssgproject.content_rule_passwd_system-auth_substack
Severity
Medium
References
Updated



Remediation - Shell Script


if ! grep -Eq "^[\s]*password[\s]+substack[\s]+system-auth\s*$" /etc/pam.d/passwd; then
    echo 'password    substack    system-auth' >> /etc/pam.d/passwd
fi

Remediation - Ansible

- name: Ensure PAM's passwd implements the system-auth substack
  lineinfile:
    path: /etc/pam.d/passwd
    create: false
    regexp: ^\s*password\s+substack\s+system-auth\s*$
    line: password    substack     system-auth