Skip to content
ATO Pathways
  Log In

Verify that 'use_mappers' is set to 'pwent' in PAM

An XCCDF Rule

Description

The operating system must map the authenticated identity to the user or group account for PKI-based authentication. Verify that use_mappers is set to pwent in /etc/pam_pkcs11/pam_pkcs11.conf file with the following command: 

$ grep ^use_mappers /etc/pam_pkcs11/pam_pkcs11.conf

use_mappers = pwent

Rationale

Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.

ID
xccdf_org.ssgproject.content_rule_verify_use_mappers
Severity
Low
References
Updated



Remediation - Ansible

- name: Verify that 'use_mappers' is set to 'pwent' in PAM
  lineinfile:
    path: /etc/pam_pkcs11/pam_pkcs11.conf
    create: true
    line: use_mappers = pwent
    state: present

Remediation - Shell Script

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if [ -e "/etc/pam_pkcs11/pam_pkcs11.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*use_mappers = pwent/Id" "/etc/pam_pkcs11/pam_pkcs11.conf"