Cis Ubuntu2004 V300 5 3 3 4 1

5.3.3.4.1 Ensure pam_unix does not include nullok (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

The nullok argument overrides the default action of pam_unix.so to not permit the user access to a service if their official password is blank.

Rationale

Using a strong password is essential to helping protect personal and sensitive information from unauthorized access.

Audit Procedure

Command Line

Run the following command to verify that the nullok argument is not set on the pam_unix.so module:

# grep -PHs -- '^\h*[^#\n\r]+\h+pam_unix\.so\h+([^#\n\r]+\h+)?nullok\b' /etc/pam.d/common-{password,auth,account,session,session-noninteractive}

Expected Result

Nothing should be returned.

Remediation

Command Line

Run the following command:

# grep -PH -- '^\h*([^#\n\r]+\h+)?pam_unix\.so\h+([^#\n\r]+\h+)?nullok\b' /usr/share/pam-configs/*

Edit any files returned and remove the nullok argument for the pam_unix lines.

Example File:

Name: Unix authentication
Default: yes
Priority: 256
Auth-Type: Primary
Auth:
        [success=end default=ignore]    pam_unix.so try_first_pass # <- **ensure line does not include nullok nullok**
Auth-Initial:
        [success=end default=ignore]    pam_unix.so # <- **ensure line does not include nullok nullok**
Account-Type: Primary
Account:
        [success=end new_authtok_reqd=done default=ignore]    pam_unix.so
Account-Initial:
        [success=end new_authtok_reqd=done default=ignore]    pam_unix.so
Session-Type: Additional
Session:
        required        pam_unix.so
Session-Initial:
        required        pam_unix.so
Password-Type: Primary
Password:
        [success=end default=ignore]    pam_unix.so obscure use_authtok try_first_pass yescrypt
Password-Initial:
        [success=end default=ignore]    pam_unix.so obscure yescrypt

Run the following command to update the files in the /etc/pam.d/ directory:

# pam-auth-update --enable <EDITED_PROFILE_NAME>

Example:

# pam-auth-update --enable unix

Note: If custom files are being used, the corresponding files in /etc/pam.d/ would need to be edited directly, and the pam-auth-update --enable <EDITED_PROFILE_NAME> command skipped.

References

None listed.

CIS Controls

MITRE ATT&CK Mappings