Profile Applicability:
 • Level 1

Description:
 The UsePAM option in the SSH daemon (sshd) configuration enables Pluggable Authentication Modules (PAM) for authentication and account management. Enabling this option allows centralized and flexible authentication management.

Rationale:
 Using PAM enhances authentication security by integrating with system-wide policies such as password complexity, account lockout, and two-factor authentication.

Impact:
 Pros:

  • Supports advanced and consistent authentication policies.

  • Enables integration with various authentication modules.

Cons:

  • Misconfigured PAM can cause authentication issues.

Default Value:
 Often enabled by default on most modern Linux distributions.

Pre-requisites:

  • Root or sudo privileges to modify SSH daemon configuration.

Remediation:

Test Plan:

Using Linux command line:

Check current UsePAM setting in /etc/ssh/sshd_config:

grep ^UsePAM /etc/ssh/sshd_config

  1. Verify it is set to yes.

Implementation Plan:

Using Linux command line:

Edit /etc/ssh/sshd_config:
vi /etc/ssh/sshd_config
Set UsePAM to yes:
UsePAM yes

Save the file and restart sshd:

systemctl restart sshd

Confirm the setting:

grep ^UsePAM /etc/ssh/sshd_config

Backout Plan:

Using Linux command line:

  1. Set UsePAM to no if necessary.

  2. Restart sshd and verify authentication behavior.

References: