In this lesson, you will learn how to verify that your system’s Pluggable Authentication Modules (PAM) align with established CIS (Center for Internet Security) security benchmarks.
Understanding CIS Benchmarks in PAM
CIS Benchmarks provide prescriptive guidance for hardening Linux systems. When it comes to PAM, these benchmarks focus on preventing password reuse, enforcing complexity, and restricting access to critical authentication files. While you might have automated security audits running, mapping your actual configuration files—like /etc/pam.d/common-password or /etc/pam.d/system-auth—against these requirements ensures your identity stack is compliant.
Auditing Password Complexity
A common CIS requirement is ensuring passwords meet length and complexity standards. For example, CIS might require the pam_pwquality.so module to be configured with specific parameters to prevent weak passwords.
To audit this, you inspect your /etc/pam.d/common-password file. A compliant configuration looks like this:
password requisite pam_pwquality.so retry=3 minlen=14 difok=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1
Here, minlen=14 and the credit values (requiring at least one uppercase, lowercase, digit, and special character) map directly to the CIS "Password Complexity" control. If your configuration lacks these flags, you are failing the audit requirement.
Restricting Access to Authentication Files
Another critical CIS benchmark is the restriction of file permissions on PAM configurations. Because these files control how users gain access to the system, they must not be world-writable. You can map this requirement to your filesystem audit:
# CIS Audit Command
stat -c "%a %U %G" /etc/pam.d/common-password
A compliant output should show permissions like 644 or 600, owned by root:root. If you find a file with global write permissions, it fails the benchmark immediately.
Why Mapping Matters
Mapping isn't just about reading a checklist; it’s about verifying that the logic of your PAM stack satisfies the intent of the benchmark. By aligning your configuration with these standards, you reduce the surface area for brute-force attacks and unauthorized account modification.
Key Takeaway: Mapping PAM configurations to CIS benchmarks involves verifying both the specific module parameters that enforce password strength and the underlying file-system permissions that protect your authentication logic from tampering.