mediumaccess-controlverified ✓rollback-safe

Ensure pam_unix includes use_authtok

pam-unix-use-authtok · RHEL ≥ 8 · 1 impl

Description

The pam_unix module should include use_authtok to ensure the password set by pam_pwquality is used rather than prompting again.

Rationale

Without use_authtok, users would be prompted for their password twice and password quality checks could be bypassed.

Check → Remediate

Checkcommand

# Check for use_authtok in pam_unix password line
if grep -E '^password.*pam_unix\.so.*use_authtok' /etc/pam.d/system-auth 2>/dev/null; then
  echo "OK: pam_unix includes use_authtok"
  exit 0
fi
echo "FAIL: pam_unix missing use_authtok"
exit 1

expected_exit:: 0

Remediatepam_module_arg

action:: ensure
module:: pam_unix.so
arg:: use_authtok
type:: password
files:: /etc/pam.d/system-auth

Framework references

CIS

rhel9 5.3.3.4.4rhel10 5.3.2.4.4rhel8 5.3.3.4.4

NIST 800-53

IA-5

Live verification

rhel10:checkrhel9:check

#pam#password#authtok#security