highaccess-controlverified ✓rollback-safe

Ensure pam_unix module is enabled

pam-unix-enabled · RHEL ≥ 8 · 1 impl

Description

The pam_unix module provides standard UNIX authentication and should be enabled in the PAM configuration.

Rationale

pam_unix is the core authentication module that validates passwords against /etc/shadow. It must be properly configured.

Check → Remediate

Checkcommand

# Check for pam_unix in auth and password stacks
if grep -qE '^auth.*pam_unix\.so' /etc/pam.d/system-auth 2>/dev/null && \
   grep -qE '^password.*pam_unix\.so' /etc/pam.d/system-auth 2>/dev/null; then
  echo "OK: pam_unix enabled in system-auth"
  exit 0
fi
echo "FAIL: pam_unix not properly configured"
exit 1

expected_exit:: 0

Remediatepam_module_configure

service:: system-auth
module:: pam_unix.so
type:: auth
control:: sufficient

Framework references

CIS

rhel9 5.3.2.5rhel10 5.3.1.5rhel8 5.3.2.5

NIST 800-53

IA-5

Live verification

rhel10:checkrhel8:checkrhel9:check

#pam#authentication#unix#security