<Group id="accounts-pam">
<title>Protect Accounts by Configuring PAM</title>
<description>PAM, or Pluggable Authentication Modules, is a system
which implements modular authentication for Linux programs. PAM provides
a flexible and configurable architecture for authentication, and it should be configured
to minimize exposure to unnecessary risk. This section contains
guidance on how to accomplish that.
<br /><br />
PAM is implemented as a set of shared objects which are
loaded and invoked whenever an application wishes to authenticate a
user. Typically, the application must be running as root in order
to take advantage of PAM, because PAM's modules often need to be able
to access sensitive stores of account information, such as /etc/shadow.
Traditional privileged network listeners
(e.g. sshd) or SUID programs (e.g. sudo) already meet this
requirement. An SUID root application, userhelper, is provided so
that programs which are not SUID or privileged themselves can still
take advantage of PAM.
<br /><br />
PAM looks in the directory <tt>/etc/pam.d</tt> for
application-specific configuration information. For instance, if
the program login attempts to authenticate a user, then PAM's
libraries follow the instructions in the file <tt>/etc/pam.d/login</tt>
to determine what actions should be taken.
<br /><br />
One very important file in <tt>/etc/pam.d</tt> is
<tt>/etc/pam.d/system-auth</tt>. This file, which is included by
many other PAM configuration files, defines 'default' system authentication
measures. Modifying this file is a good way to make far-reaching
authentication changes, for instance when implementing a
centralized authentication service.</description>
<warning category="general">Be careful when making changes to PAM's
configuration files. The syntax for these files is complex, and
modifications can have unexpected consequences. The default
configurations shipped with applications should be sufficient for
most users.</warning>
<warning category="general">Running <tt>authconfig</tt> or
<tt>system-config-authentication</tt> will re-write the PAM configuration
files, destroying any manually made changes and replacing them with
a series of system defaults. One reference to the configuration
file syntax can be found at
http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-configuration-file.html.</warning>

<Rule id="accounts_global_setting">
<title>Configure Global Account Settings</title>
<description>The <tt>/etc/pam.d/system-auth</tt> file must not be  a symbolic link to 
<tt>/etc/pam.d/system-auth-ac</tt>. The <tt>/etc/pam.d/system-auth</tt> file must instead 
link to an alternate file, such as <tt>/etc/pam.d/system-auth-local</tt>, which incorporates 
<tt>include</tt> statements for system-auth-ac. Specifically, the following <tt>include</tt> 
statements should be present:
<pre>auth include system-auth-ac</pre>
<pre>account include system-auth-ac</pre>
<pre>password include system-auth-ac</pre>
<pre>session include system-auth-ac</pre>
</description>
<rationale>
Pam global requirements are generally defined in the /etc/pam.d/system-auth or /etc/pam.d/system-auth-ac 
file. In order for the requirements to be applied the file containing them must be included directly or 
indirectly in each program's definition file in /etc/pam.d.
</rationale>
<ident stig="GEN000600-2" />
<oval id="accounts_global_setting"/>
<ref nist="ECSC-1" disa="192" />
</Rule>

<Rule id="accounts_logins_logged">
<title>Ensure Account Logins are Logged</title>
<description>
</description>
<rationale>
Monitoring and recording successful and unsuccessful logins assists in tracking unauthorized access to 
the system.  Without this logging, the ability to track unauthorized activity to specific user accounts 
may be diminished.
</rationale>
<ident stig="GEN000440" />
<ref nist="ECAR-1,ECAR-2,ECAR-3" disa="126" />
<oval id="accounts_logins_logged"/>
</Rule>

<Group id="password_quality">
<title>Set Password Quality Requirements</title>
<description>The default <tt>pam_cracklib</tt> PAM module provides strength
checking for passwords. It performs a number of checks, such as
making sure passwords are not similar to dictionary words, are of
at least a certain length, are not the previous password reversed,
and are not simply a change of case from the previous password. It
can also require passwords to be in certain character classes.
<br /><br />
The <tt>pam_passwdqc</tt> PAM module also provides the ability to enforce
stringent password strength requirements. It is provided
in an RPM of the same name.
<br /><br />
The man pages <tt>pam_cracklib(8)</tt> and <tt>pam_passwdqc(8)</tt>
provide information on the capabilities and configuration of
each.</description>

<Group id="password_quality_pamcracklib">
<title>Set Password Quality Requirements, if using
pam_cracklib</title>
<description>The <tt>pam_cracklib</tt> PAM module can be configured to meet
requirements for a variety of policies.
<br /><br />
For example, to configure <tt>pam_cracklib</tt> to require at least one uppercase
character, lowercase character, digit, and other (special)
character, locate the following line in <tt>/etc/pam.d/system-auth</tt>:
<pre>password requisite pam_cracklib.so try_first_pass retry=3</pre>
and then alter it to read:
<pre>password required pam_cracklib.so try_first_pass retry=3 maxrepeat=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4</pre>
If no such line exists, add one as the first line of the password section in <tt>/etc/pam.d/system-auth</tt>.
The arguments can be modified to ensure compliance with
your organization's security policy. Discussion of each parameter follows.
</description>
<warning category="general">Note that the password quality
requirements are not enforced for the root account for some
reason.</warning>

<Value id="var_password_pam_cracklib_retry" type="number" operator="equals" interactive="0">
<title>retry</title>
<description>Number of retry attempts before erroring out</description>
<value selector="">3</value>
<value selector="1">1</value>
<value selector="2">2</value>
<value selector="3">3</value>
</Value>
<Value id="var_password_pam_cracklib_minlen" type="number"
operator="equals" interactive="0">
<title>minlen</title>
<description>Minimum number of characters in password</description>
<value selector="">14</value>
<value selector="6">6</value>
<!-- NIST 800-53 requires 1 in a million using brute force which translates to six numbers -->
<value selector="8">8</value>
<value selector="10">10</value>
<value selector="12">12</value>
<value selector="14">14</value>
<value selector="15">15</value>
</Value>
<Value id="var_password_pam_cracklib_dcredit" type="number"
operator="equals" interactive="0">
<title>dcredit</title>
<description>Minimum number of digits in password</description>
<value selector="">-1</value>
<value selector="2">-2</value>
<value selector="1">-1</value>
<value selector="0">0</value>
</Value>
<Value id="var_password_pam_cracklib_ocredit" type="number"
operator="equals" interactive="0">
<title>ocredit</title>
<description>Minimum number of other (special characters) in
password</description>
<value selector="">-1</value>
<value selector="2">-2</value>
<value selector="1">-1</value>
<value selector="0">0</value>
</Value>
<Value id="var_password_pam_cracklib_lcredit" type="number"
operator="equals" interactive="0">
<title>lcredit</title>
<description>Minimum number of lower case in password</description>
<value selector="">-1</value>
<value selector="2">-2</value>
<value selector="1">-1</value>
<value selector="0">0</value>
</Value>
<Value id="var_password_pam_cracklib_ucredit" type="number"
operator="equals" interactive="0">
<title>ucredit</title>
<description>Minimum number of upper case in password</description>
<value selector="">-1</value>
<value selector="2">-2</value>
<value selector="1">-1</value>
<value selector="0">0</value>
</Value>
<Value id="var_password_pam_cracklib_difok" type="number"
operator="equals" interactive="0">
<title>difok</title>
<description>Minimum number of characters not present in old
password</description>
<warning category="general">Keep this high for short
passwords</warning>
<value selector="">4</value>
<value selector="2">2</value>
<value selector="3">3</value>
<value selector="4">4</value>
<value selector="5">5</value>
</Value>
<Value id="var_password_pam_cracklib_maxrepeat" type="number"
operator="equals" interactive="0">
<title>maxrepeat</title>
<description>Minimum number of consecutive repeating characters</description>
<warning category="general">Keep this high for short
passwords</warning>
<value selector="">3</value>
<value selector="2">2</value>
<value selector="3">3</value>
<value selector="4">4</value>
<value selector="5">5</value>
</Value>
<Value id="var_accounts_password_pam_tally_deny" type="number"
operator="equals" interactive="0">
<title>fail_deny</title>
<description>Number of failed login attempts before account lockout</description>
<value selector="">3</value>
<value selector="3">3</value>
<value selector="5">5</value>
<value selector="10">10</value>
</Value>
<Value id="var_accounts_passwords_pam_faillock_unlock_time" type="number"
operator="equals" interactive="0">
<title>fail_unlock_time</title>
<description>Seconds before automatic unlocking after excessive failed logins</description>
<value selector="">604800</value>
<value selector="900">900</value> <!-- 15 minutes -->
<value selector="1800">1800</value> <!-- 30 minutes -->
<value selector="3600">3600</value> <!-- 1 hour -->
<value selector="86400">86400</value> <!-- 1 day -->
<value selector="604800">604800</value> <!-- 7 days -->
</Value>
<Value id="var_accounts_passwords_pam_faillock_fail_interval" type="number"
operator="equals" interactive="0">
<title>fail_interval</title>
<description>Interval for counting failed login attempts before account lockout</description>
<value selector="">900</value>
<value selector="900">900</value> <!-- 15 minutes -->
<value selector="1800">1800</value> <!-- 30 minutes -->
<value selector="3600">3600</value> <!-- 1 hour -->
<value selector="86400">86400</value> <!-- 1 day -->
<value selector="100000000">100000000</value> <!-- 3.16 years -->
</Value>
<Value id="password_history_retain_number" type="number"
operator="equals" interactive="0">
<title>remember</title>
<description>The last n passwords for each user are saved in
<tt>/etc/security/opasswd</tt> in order to force password change history and
keep the user from alternating between the same password too frequently.</description>
<value selector="">24</value>
<value selector="0">0</value>
<value selector="5">5</value>
<value selector="10">10</value>
<value selector="24">24</value>
</Value>

<Rule id="accounts_cracklib_present">
<title>Include Cracklib Password Module</title>
<description>To ensure the cracklib password module is being enforced and its configuration 
is not being overwritten by authconfig, the cracklib module must be defined in /etc/pam.d/system-auth. 
Additionally, the /etc/pam.d/passwd file must ensure the <tt>password include</tt> statement points to 
system-auth and not system-auth-ac.
</description>
<ocil clause="maxrepeat is not found or not set to the required value">
To check the maximum value for consecutive repeating characters, run the following command:
<pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
Look for the value of the <tt>password required pam_cracklib.so</tt> parameter.
</ocil>
<rationale>
An easily guessable password provides an open door to any external or internal malicious intruder.  
Many computer compromises occur as the result of account name and password guessing.  
This is generally done by someone with an automated script that uses repeated logon attempts until 
the correct account and password pair is guessed.  Utilities, such as cracklib, can be used to 
validate passwords are not dictionary words and meet other criteria during password changes.
</rationale>
<ident stig="GEN000790" />
<oval id="accounts_cracklib_present"/>
<ref nist="IAIA-1,IAIA-2" disa="189" />
</Rule>

<Rule id="accounts_password_pam_cracklib_minlen" severity="medium">
<title>Set Password Minimum Length</title>
<description>To specify password length requirements for new accounts,
edit the file <tt>/etc/login.defs</tt> and add or correct the following
lines:
<pre>PASS_MIN_LEN 14<!-- <sub idref="var_password_pam_cracklib_minlen"> --></pre>
<br/><br/>
The DoD requirement is <tt>14</tt>. 
The FISMA requirement is <tt>12</tt>.
If a program consults <tt>/etc/login.defs</tt> and also another PAM module
(such as <tt>pam_cracklib</tt>) during a password change operation,
then the most restrictive must be satisfied. See PAM section
for more information about enforcing password quality requirements.
</description>
<ocil clause="it is not set to the required value">
To check the minimum password length, run the command:
<pre>$ grep PASS_MIN_LEN /etc/login.defs</pre>
The DoD requirement is <tt>14</tt>. 
</ocil>
<rationale>
Requiring a minimum password length makes password
cracking attacks more difficult by ensuring a larger
search space. However, any security benefit from an onerous requirement
must be carefully weighed against usability problems, support costs, or counterproductive
behavior that may result.
</rationale>
<ident stig="GEN000585" />
<oval id="accounts_password_pam_cracklib_minlen" value="var_password_pam_cracklib_minlen"/>
<ref nist="IAIA-1,IAIA-2" disa="205" />
</Rule>

<Rule id="accounts_password_pam_cracklib_maxrepeat">
<title>Set Password to Maximum of Three Consecutive Repeating Characters</title>
<description>The pam_cracklib module's <tt>maxrepeat</tt> parameter controls requirements for
consecutive repeating characters. When set to a positive number, it will reject passwords
which contain more than that number of consecutive characters. Add <tt>maxrepeat=3</tt>
after pam_cracklib.so to prevent a run of four or more identical characters.
</description>
<ocil clause="maxrepeat is not found or not set to the required value">
To check the maximum value for consecutive repeating characters, run the following command:
<pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
Look for the value of the <tt>maxrepeat</tt> parameter. The DoD requirement is 3.
</ocil>
<rationale>
Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks.
</rationale>
<ident stig="GEN000680" />
<oval id="accounts_password_pam_cracklib_maxrepeat" value="var_password_pam_cracklib_maxrepeat"/>
<ref nist="IAIA-1,IAIA-2" disa="366" />
</Rule>

<Rule id="accounts_password_pam_cracklib_dcredit">
<title>Set Password Strength Minimum Digit Characters</title>
<description>The pam_cracklib module's <tt>dcredit</tt> parameter controls requirements for
usage of digits in a password. When set to a negative number, any password will be required to
contain that many digits. When set to a positive number, pam_cracklib will grant +1 additional
length credit for each digit.  
Add <tt>dcredit=-1</tt> after pam_cracklib.so to require use of a digit in passwords.
</description>
<ocil clause="dcredit is not found or not set to the required value">
To check how many digits are required in a password, run the following command:
<pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
The <tt>dcredit</tt> parameter (as a negative number) will indicate how many digits are required.
The DoD requires at least one digit in a password.
This would appear as <tt>dcredit=-1</tt>.
</ocil>
<rationale>
Requiring digits makes password guessing attacks more difficult by ensuring a larger
search space.
</rationale>
<ident stig="GEN000620" />
<oval id="accounts_password_pam_cracklib_dcredit" value="var_password_pam_cracklib_dcredit"/>
<ref nist="IAIA-1,IAIA-2" disa="194" />
</Rule>

<Rule id="accounts_password_pam_cracklib_ucredit">
<title>Set Password Strength Minimum Uppercase Characters</title>
<description>The pam_cracklib module's <tt>ucredit=</tt> parameter controls requirements for
usage of uppercase letters in a password. When set to a negative number, any password will be required to
contain that many uppercase characters. When set to a positive number, pam_cracklib will grant +1 additional
length credit for each uppercase character.
Add <tt>ucredit=-1</tt> after pam_cracklib.so to require use of an upper case character in passwords.
</description>
<ocil clause="ucredit is not found or not set to the required value">
To check how many uppercase characters are required in a password, run the following command:
<pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
The <tt>ucredit</tt> parameter (as a negative number) will indicate how many uppercase characters are required.
The DoD and FISMA require at least one uppercase character in a password.
This would appear as <tt>ucredit=-1</tt>.
</ocil>
<rationale>
Requiring a minimum number of uppercase characters makes password guessing attacks
more difficult by ensuring a larger search space.
</rationale>
<ident stig="GEN000600" />
<oval id="accounts_password_pam_cracklib_ucredit" value="var_password_pam_cracklib_ucredit"/>
<ref nist="IAIA-1,IAIA-2" disa="192" />
</Rule>

<Rule id="accounts_password_pam_cracklib_ocredit">
<title>Set Password Strength Minimum Special Characters</title>
<description>The pam_cracklib module's <tt>ocredit=</tt> parameter controls requirements for
usage of special (or ``other'') characters in a password. When set to a negative number, any password will be required to
contain that many special characters. When set to a positive number, pam_cracklib will grant +1 additional
length credit for each special character.
Add <tt>ocredit=-1</tt> after pam_cracklib.so to require use of a special character in passwords.
</description>
<ocil clause="ocredit is not found or not set to the required value">
To check how many special characters are required in a password, run the following command:
<pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
The <tt>ocredit</tt> parameter (as a negative number) will indicate how many special characters are required.
The DoD and FISMA require at least one special character in a password.
This would appear as <tt>ocredit=-1</tt>.
</ocil>
<rationale>
Requiring a minimum number of special characters makes password guessing attacks
more difficult by ensuring a larger search space.
</rationale>
<ident stig="GEN000640" />
<oval id="accounts_password_pam_cracklib_ocredit" value="var_password_pam_cracklib_ocredit"/>
<ref nist="IAIA-1,IAIA-2" disa="1619" />
</Rule>

<Rule id="accounts_password_pam_cracklib_lcredit">
<title>Set Password Strength Minimum Lowercase Characters</title>
<description>The pam_cracklib module's <tt>lcredit=</tt> parameter controls requirements for
usage of lowercase letters in a password. When set to a negative number, any password will be required to
contain that many lowercase characters. When set to a positive number, pam_cracklib will grant +1 additional
length credit for each lowercase character.
Add <tt>lcredit=-1</tt> after pam_cracklib.so to require use of a lowercase character in passwords.
</description>
<ocil clause="lcredit is not found or not set to the required value">
To check how many lowercase characters are required in a password, run the following command:
<pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
The <tt>lcredit</tt> parameter (as a negative number) will indicate how many special characters are required.
The DoD and FISMA require at least one lowercase character in a password.
This would appear as <tt>lcredit=-1</tt>.
</ocil>
<rationale>
Requiring a minimum number of lowercase characters makes password guessing attacks
more difficult by ensuring a larger search space.
</rationale>
<ident stig="GEN000610" />
<oval id="accounts_password_pam_cracklib_lcredit" value="var_password_pam_cracklib_lcredit"/>
<ref nist="IAIA-1,IAIA-2" disa="193" />
</Rule>

<Rule id="accounts_password_pam_cracklib_difok">
<title>Set Password Strength Minimum Different Characters</title>
<description>The pam_cracklib module's <tt>difok</tt> parameter controls requirements for
usage of different characters during a password change.
Add <tt>difok=<i>NUM</i></tt> after pam_cracklib.so to require differing
characters when changing passwords, substituting <i>NUM</i> appropriately.
The DoD requirement is <tt>4</tt>.
</description>
<ocil clause="difok is not found or not set to the required value">
To check how many characters must differ during a password change, run the following command:
<pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
The <tt>difok</tt> parameter will indicate how many characters must differ.
The DoD requires four characters differ during a password change.
This would appear as <tt>difok=4</tt>.
</ocil>
<rationale>
Requiring a minimum number of different characters during password changes ensures that
newly changed passwords should not resemble previously compromised ones.
Note that passwords which are changed on compromised systems will still be compromised, however.
</rationale>
<ident stig="GEN000750" />
<oval id="accounts_password_pam_cracklib_difok" value="var_password_pam_cracklib_difok"/>
<ref nist="IAIA-1,IAIA-2" disa="195" />
</Rule>

<Rule id="accounts_password_pam_unix_remember" severity="medium">
<title>Limit Password Reuse</title>
<description>Do not allow users to reuse recent passwords. This can
be accomplished by using the <tt>remember</tt> option for the <tt>pam_unix</tt> PAM
module.  In the file <tt>/etc/pam.d/system-auth</tt>, append <tt>remember=24</tt> to the 
line which refers to the <tt>pam_unix.so</tt> module, as shown:
<pre>password sufficient pam_unix.so <i>existing_options</i> remember=24</pre>
The DoD and FISMA requirement is 24 passwords.</description>
<ocil clause="it does not">
To verify the password reuse setting is compliant, run the following command:
<pre>$ grep remember /etc/pam.d/system-auth</pre>
The output should show the following at the end of the line:
<pre>remember=24</pre>
</ocil>
<rationale>
Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.
</rationale>
<ident stig="GEN000800" />
<oval id="accounts_password_pam_unix_remember" value="password_history_retain_number" />
<ref nist="IAIA-1,IAIA-2" disa="200" />
</Rule>
</Group>
</Group>

<Group id="authentication_failure_handling">
<title>Set Authentication Failure Actions</title>
<description>The system should be configured to handle authentication 
failures so that password cracking attempts are mitigated.
</description>
<warning category="general">Locking out user accounts presents the
risk of a denial-of-service attack. The lockout policy
must weigh whether the risk of such a
denial-of-service attack outweighs the benefits of thwarting
password guessing attacks.</warning>

<!-- This should probably be two rules:
one to use pam_faillock,
and a second to use unlock_time and set it to a Value
-->

<Rule id="accounts_password_pam_tally_deny" severity="medium">
<title>Set Deny For Failed Password Attempts</title>
<description>
To configure the system to lock out accounts after a number of incorrect login
attempts using <tt>pam_faillock.so</tt>:
<br /><br />
Add the following lines immediately below the <tt>pam_unix.so</tt> statement in <tt>AUTH</tt> section of
<tt>/etc/pam.d/system-auth</tt>:
<pre>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900</pre>
<pre>auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900</pre>
</description>
<ocil clause="that is not the case">
To ensure the failed password attempt policy is configured correctly, run the following command:
<pre># grep pam_faillock /etc/pam.d/system-auth</pre>
The output should show <tt>deny=3</tt>.
</ocil>
<rationale>
Locking out user accounts after a number of incorrect attempts
prevents direct password guessing attacks.
</rationale>
<ident stig="GEN000460" />
<oval id="accounts_password_pam_tally_deny" value="var_accounts_password_pam_tally_deny"/>
<ref nist="ECLO-1,ECLO-2" disa="44" />
</Rule>

<Rule id="accounts_fail_delay" severity="medium">
<title>Set Delay Between Failed Password Attempts</title>
<description>
Check the value of the FAIL_DELAY variable and the ability to use it.
</description>
<rationale>
Enforcing a delay between successive failed login attempts increases protection against automated 
password guessing attacks.
</rationale>
<ident stig="GEN000480" />
<oval id="accounts_fail_delay"/>
<ref nist="ECLO-1,ECLO-2" disa="43" />
</Rule>
</Group>

<Group id="set_password_hashing_algorithm">
<title>Set Password Hashing Algorithm</title>
<description>The system's default algorithm for storing password hashes in
<tt>/etc/shadow</tt> is SHA-512. This can be configured in several
locations.</description>

<Rule id="set_password_hashing_algorithm_systemauth" severity="medium">
<title>Set Password Hashing Algorithm in /etc/pam.d/system-auth</title>
<description>
In <tt>/etc/pam.d/system-auth</tt>, the <tt>password</tt> section of
the file controls which PAM modules execute during a password change.
Set the <tt>pam_unix.so</tt> module in the
<tt>password</tt> section to include the argument <tt>sha512</tt>, as shown below:
<pre>password    sufficient    pam_unix.so sha512 <i>other arguments...</i></pre>
This will help ensure when local users change their passwords, hashes for the new
passwords will be generated using the SHA-512 algorithm.
This is the default.
</description>
<ocil clause="it does not">
Inspect the <tt>password</tt> section of <tt>/etc/pam.d/system-auth</tt>  and
ensure that the <tt>pam_unix.so</tt> module includes the argument
<tt>sha512</tt>:
<pre>$ grep sha512 /etc/pam.d/system-auth</pre>
</ocil>
<rationale>
Using a stronger hashing algorithm makes password cracking attacks more difficult.
</rationale>
<ident stig="GEN000590" />
<ref nist="DCNR-1,IAIA-1,IAIA-2" disa="803" />
<oval id="set_password_hashing_algorithm_systemauth" />
</Rule>

</Group>
</Group>
