Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The Red Hat Enterprise Linux operating system must be configured so that /etc/pam.d/passwd implements /etc/pam.d/system-auth when changing passwords.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-204405 | RHEL-07-010118 | SV-204405r603261_rule | Medium |
| Description |
|---|
| Pluggable authentication modules (PAM) allow for a modular approach to integrating authentication methods. PAM operates in a top-down processing model and if the modules are not listed in the correct order, an important security function could be bypassed if stack entries are not centralized. |
| STIG | Date |
|---|---|
| Red Hat Enterprise Linux 7 Security Technical Implementation Guide | 2023-03-08 |
Details
| Check Text ( C-4529r88407_chk ) |
|---|
| Verify that /etc/pam.d/passwd is configured to use /etc/pam.d/system-auth when changing passwords: # cat /etc/pam.d/passwd | grep -i substack | grep -i system-auth password substack system-auth If no results are returned, the line is commented out, this is a finding. |
| Fix Text (F-4529r88408_fix) |
|---|
| Configure PAM to utilize /etc/pam.d/system-auth when changing passwords. Add the following line to "/etc/pam.d/passwd" (or modify the line to have the required value): password substack system-auth |