Skip to content
ATO Pathways
  Log In

The PAM configuration should not be changed automatically

An XCCDF Rule

Description

Verify the SUSE operating system is configured to not overwrite Pluggable Authentication Modules (PAM) configuration on package changes.

Rationale

pam-config is a command line utility that automatically generates a system PAM configuration as packages are installed, updated or removed from the system. pam-config removes configurations for PAM modules and parameters that it does not know about. It may render ineffective PAM configuration by the system administrator and thus impact system security.

ID
xccdf_org.ssgproject.content_rule_pam_disable_automatic_configuration
Severity
Medium
References
Updated



Remediation - Ansible

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-85641-9
  - DISA-STIG-SLES-15-040220

Remediation - Shell Script

# Remediation is applicable only in certain platforms
if rpm --quiet -q pam_apparmor; then

while IFS= read -r -d '' link; do
    target=$(readlink -f "$link")
    cp -p --remove-destination "$target" "$link"