mediumaccess-controlverified ✓

Ensure active authselect profile includes pam modules

authselect-profile-pam · RHEL ≥ 8 · 1 impl

Description

The active authselect profile should include the necessary PAM modules for authentication, password, and session management.

Rationale

authselect profiles ensure consistent PAM configuration. The active profile should include all required security modules like faillock, pwquality, and pwhistory.

Check → Remediate

Checkcommand

# Check if authselect is managing PAM
profile=$(authselect current 2>/dev/null | grep "Profile ID:" | awk '{print $3}')
if [ -z "$profile" ]; then
  echo "FAIL: No authselect profile is active"
  exit 1
fi

# Verify expected PAM modules are enabled
features=$(authselect current 2>/dev/null | grep -E "with-faillock|with-pwhistory")
echo "OK: authselect profile $profile is active"
exit 0

expected_exit:: 0

Remediatemanual

note:: Configure authselect with an appropriate profile. Example: authselect select sssd with-faillock with-pwhistory --force

Framework references

CIS

rhel9 5.3.2.1rhel10 5.3.1.1rhel8 5.3.2.1

NIST 800-53

IA-5CM-6

Live verification

rhel10:checkrhel8:checkrhel9:check

#authselect#pam#authentication#security