highaccess-controlverified ✓

Prohibit null passwords in the PAM authentication stack

pam-null-passwords-prohibited-common · UBUNTU ≥ 22 · 1 impl

Description

The nullok option must not appear on any active line in /etc/pam.d/common-auth or /etc/pam.d/common-password, so that accounts with an empty password cannot be used to authenticate.

Rationale

The nullok option lets an account with no password authenticate without supplying one. On Debian-family systems the PAM stack is configured in common-auth / common-password, so null-password acceptance must be denied where the platform enforces authentication.

Check → Remediate

Checkcommand

hits=$(grep -hE 'nullok' /etc/pam.d/common-password /etc/pam.d/common-auth 2>/dev/null | grep -vE '^[[:space:]]*#')
[ -z "$hits" ] || { echo "FAIL: nullok present in PAM stack:"; printf '%s\n' "$hits"; exit 1; }
echo "OK: no active nullok in common-auth/common-password"; exit 0

expected_exit:: 0

Remediatemanual

note:: Remove every 'nullok' option from active lines in /etc/pam.d/common-password and /etc/pam.d/common-auth (managed via pam-auth-update), so empty passwords cannot be used to authenticate.

Framework references

STIG

V-270714 / UBTU-24-300028V-260570 / UBTU-22-611060

NIST 800-53

IA-5(1)

Live verification

ubuntu22:checkubuntu24:check

#pam#authentication#nullok#null-password#stig