Cis Ubuntu2004 V300 5 3 3 3 3

5.3.3.3.3 Ensure pam_pwhistory includes use_authtok (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

use_authtok - When password changing enforce the module to set the new password to the one provided by a previously stacked password module.

Rationale

use_authtok allows multiple pam modules to confirm a new password before it is accepted.

Audit Procedure

Command Line

Run the following command to verify that the use_authtok argument exists on the pwhistory line in /etc/pam.d/common-password:

# grep -Psi -- '^\h*password\h+[^#\n\r]+\h+pam_pwhistory\.so\h+([^#\n\r]+\h+)?use_authtok\b' /etc/pam.d/common-password

Expected Result

Output should be similar to:

password   requisite   pam_pwhistory.so remember=24 enforce_for_root use_authtok

Remediation

Command Line

Run the following command:

# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_pwhistory\.so/) print FILENAME}' /usr/share/pam-configs/*

Edit any returned files and add the use_authtok argument to the pam_pwhistory line in the Password section:

Example File:

Name: pwhistory password history checking
Default: yes
Priority: 1024
Password-Type: Primary
Password:
   requisite   pam_pwhistory.so remember=24 enforce_for_root use_authtok # <- **ensure line includes use_authtok**

Run the following command to update the files in the /etc/pam.d/ directory:

# pam-auth-update --enable <MODIFIED_PROFILE_NAME>

Example:

# pam-auth-update --enable pwhistory

References

1. NIST SP 800-53 Rev. 5: IA-5

CIS Controls

MITRE ATT&CK Mappings