Authentication Policy and Package Hygiene

PAM: Where Password Rules Are Enforced

Linux checks passwords through Pluggable Authentication Modules. A setting in pwquality.conf does nothing unless the password stack (/etc/pam.d/common-password or system-auth) calls pam_pwquality (HOST-PAM-001). NIST SP 800-63B-4 asks verifiers to reject dictionary words and known-breached passwords rather than impose composition rules. So the check looks at the module and its dictionary and user-name checks, not at character classes.

pam_faillock counts failures (HOST-PWD-004); its unlock_time decides how long the lock lasts. The default of 600 seconds lets guessing resume every ten minutes; 900 or more, or 0 for a manual unlock, makes online guessing impractical (HOST-PAM-002). pam_pwhistory or pam_unix remember= stops a user who was told to change a compromised password from setting it straight back (HOST-PAM-004). pam_wheel restricts su to an administrative group so a compromised service account cannot sit and guess the root password (HOST-PAM-003).

login.defs and Account Lifecycle

/etc/login.defs sets the defaults new accounts inherit. PASS_MIN_DAYS 1 stops a user cycling through several changes to defeat history (HOST-PAM-005). PASS_WARN_AGE 7 gives notice before an expiry, where expiry is used at all; HOST-PWD-005 explains why NIST no longer recommends routine expiry, so this one is informational (HOST-PAM-006). INACTIVE in /etc/default/useradd makes accounts lock themselves a fixed number of days after their password expires, so accounts of people who left do not stay usable for years (HOST-PAM-007). These map to CIS Controls v8 safeguards 5.2 and 5.3 and to NIST SP 800-53 IA-5 and AC-2(3).

Root's Environment

When root's PATH contains . or an empty element, typing ls in a directory an attacker controls runs the attacker's ls as root. A world-writable directory on the PATH has the same effect for any command name not found earlier. HOST-PAM-008 reads root's shell start-up files for these entries; MITRE ATT&CK calls the technique path interception. TMOUT (HOST-PAM-009) closes an idle shell so a root session left on an unattended terminal is not free privilege for the next person.

How Packages Arrive

Package installation runs as root, so each repository is a supplier trusted with the whole machine. apt and dnf verify a signature over the repository index before trusting any package. trusted=yes, AllowUnauthenticated or gpgcheck=0 switches that off. Then a mirror operator or anyone on the network path can deliver modified packages (HOST-PKG-002). Third-party repositories are not wrong in themselves, but each needs an owner and a reason (HOST-PKG-003); NIST SP 800-161 treats this as supply chain risk.

Updates only help once they are in effect. Repository metadata must be refreshed on a schedule or no tool can see pending updates (HOST-PKG-006). A kernel update protects nothing until the machine boots into it (HOST-PKG-005). Every old kernel left installed stays bootable with every vulnerability it had (HOST-PKG-004). NIST SP 800-40 Rev. 4 covers this lifecycle; the checks map to CIS Controls v8 safeguard 7.4.

Services That Came Along

A service that is installed but stopped comes back with the next upgrade or reboot and is one command away from running. HOST-SVC-001 asks what is active now. HOST-SVC-002 to 012 read the package database and the systemd boot links. They cover Telnet, the r-services and finger, TFTP, FTP, NIS, Avahi and CUPS, NFS and rpcbind. They also cover DHCP and DNS servers, Samba, SNMP and Squid, and inetd super-servers. The cleartext protocols (Telnet, rsh, TFTP, FTP, NIS) rate Medium because they send credentials or data unencrypted. The rest rate Low as attack surface with no purpose on a typical server. Where a machine legitimately runs one, the suppression file records the reason so the finding stays visible but accepted. This is NIST SP 800-123's advice to remove or disable unnecessary services, NIST SP 800-53 CM-7, and CIS Controls v8 safeguard 4.8.

In Summary

Password policy is enforced by PAM and login.defs together, so check both. Keep root's PATH clean and expire and warn on schedule. Only install packages from signed repositories you recognise, and refresh package lists. Retire old kernels and remove the legacy services that arrived with the image.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --only HOST-PAM- --out p22a and read the common-password stacks in internal/lab/fixtures_audit_pam_pkg.go side by side.
2. Run: openvapt demo --only HOST-PKG- --out p22b and find the sources.list entry that fails HOST-PKG-002 and the one listed by HOST-PKG-003.
3. Run: openvapt demo --only HOST-SVC- --out p22c and, for each failed check, decide whether removing the package or disabling the unit would be the right fix on a real server.
4. On a test machine you own: sudo openvapt scan --only HOST-PAM-,HOST-PKG-,HOST-SVC- and compare with grep pam_ /etc/pam.d/common-password and dpkg -l | grep '^ii' .

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management
• NIST SP 800-53 Rev. 5, IA-5, AC-7 and CM-7
• NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
• NIST SP 800-123, Guide to General Server Security
• pam.conf(5), Linux man-pages (PAM configuration)

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P22: Authentication Policy and Package Hygiene (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p22.html

@misc{openvapt_p22,
  author       = {{OpenVAPT}},
  title        = {{P22: Authentication Policy and Package Hygiene}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p22.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}