5.3.2.5 Ensure pam_unix module is enabled

Information

The pam_unix.so module is the standard Unix authentication module. It uses standard calls from the system's libraries to retrieve and set account information as well as authentication. Usually this is obtained from the /etc/passwd and the /etc/shadow file as well if shadow is enabled.

Requiring users to use authentication make it less likely that an attacker will be able to access the system.

Solution

Run the following script to verify the pam_unix.so lines exist in the profile templates:

#!/usr/bin/env bash

{
l_module_name="unix"
l_pam_profile="$(head -1 /etc/authselect/authselect.conf)"
if grep -Pq -- '^custom/' <<< "$l_pam_profile"; then
l_pam_profile_path="/etc/authselect/$l_pam_profile"
else
l_pam_profile_path="/usr/share/authselect/default/$l_pam_profile"
fi
grep -P -- "bpam_$l_module_name.sob" "$l_pam_profile_path"/{password,system}-auth
}

Example Output with a custom profile named "custom-profile":

/etc/authselect/custom/custom-profile/password-auth:auth sufficient pam_unix.so {if not "without-nullok":nullok}
/etc/authselect/custom/custom-profile/password-auth:account required pam_unix.so
/etc/authselect/custom/custom-profile/password-auth:password sufficient pam_unix.so sha512 shadow {if not "without-nullok":nullok} use_authtok remember=5
/etc/authselect/custom/custom-profile/password-auth:session required pam_unix.so

/etc/authselect/custom/custom-profile/system-auth:auth sufficient pam_unix.so {if not "without-nullok":nullok}
/etc/authselect/custom/custom-profile/system-auth:account required pam_unix.so
/etc/authselect/custom/custom-profile/system-auth:password sufficient pam_unix.so sha512 shadow {if not "without-nullok":nullok} use_authtok
/etc/authselect/custom/custom-profile/system-auth:session required pam_unix.so

- IF - the lines shown above are not returned, refer to the Recommendation "Ensure active authselect profile includes pam modules" to update the authselect profile template files to include the pam_unix entries before continuing this remediation.

Note: Arguments following pam_unix.so may be different than the example output

See Also

https://workbench.cisecurity.org/benchmarks/18208

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2

Plugin: Unix

Control ID: e4d770866e1df0503a6122f7b1dcb60e668c4e031f86b1d556492783770fe7da