---
title: "P22: Authentication Policy and Package Hygiene"
canonical: https://openvapt.com/academy/p22.html
html: https://openvapt.com/academy/p22.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-16
version: 0.1.0-alpha.6
---

# P22: Authentication Policy and Package Hygiene

The PAM and login.defs settings that decide how passwords are checked, reused and locked, and how root's environment can be hijacked. How packages arrive on the machine and which services came with them.

- Level: Practitioner
- Time: about 35 minutes
- Read first: P7, P15

## You Will Be Able To

- Explain what pam_pwquality, pam_faillock, pam_pwhistory and pam_wheel each decide, and read their options from a PAM stack.
- Explain the login.defs and useradd defaults that govern password age and inactive accounts, and where current NIST guidance differs from older practice.
- Recognise an unsafe root PATH and explain the privilege escalation it allows.
- Explain why repository signatures, third-party repositories, retained kernels and legacy services are patch management problems.

## PAM: Where Password Rules Are Enforced

Linux checks passwords through Pluggable Authentication Modules. A setting in pwquality.conf does nothing unless the password stack (/etc/pam.d/common-password or system-auth) calls pam_pwquality (HOST-PAM-001). NIST SP 800-63B-4 asks verifiers to reject dictionary words and known-breached passwords rather than impose composition rules. So the check looks at the module and its dictionary and user-name checks, not at character classes.

pam_faillock counts failures (HOST-PWD-004); its unlock_time decides how long the lock lasts. The default of 600 seconds lets guessing resume every ten minutes; 900 or more, or 0 for a manual unlock, makes online guessing impractical (HOST-PAM-002). pam_pwhistory or pam_unix remember= stops a user who was told to change a compromised password from setting it straight back (HOST-PAM-004). pam_wheel restricts su to an administrative group so a compromised service account cannot sit and guess the root password (HOST-PAM-003).

## login.defs and Account Lifecycle

/etc/login.defs sets the defaults new accounts inherit. PASS_MIN_DAYS 1 stops a user cycling through several changes to defeat history (HOST-PAM-005). PASS_WARN_AGE 7 gives notice before an expiry, where expiry is used at all; HOST-PWD-005 explains why NIST no longer recommends routine expiry, so this one is informational (HOST-PAM-006). INACTIVE in /etc/default/useradd makes accounts lock themselves a fixed number of days after their password expires, so accounts of people who left do not stay usable for years (HOST-PAM-007). These map to CIS Controls v8 safeguards 5.2 and 5.3 and to NIST SP 800-53 IA-5 and AC-2(3).

## Root's Environment

When root's PATH contains . or an empty element, typing ls in a directory an attacker controls runs the attacker's ls as root. A world-writable directory on the PATH has the same effect for any command name not found earlier. HOST-PAM-008 reads root's shell start-up files for these entries; MITRE ATT&CK calls the technique path interception. TMOUT (HOST-PAM-009) closes an idle shell so a root session left on an unattended terminal is not free privilege for the next person.

## How Packages Arrive

Package installation runs as root, so each repository is a supplier trusted with the whole machine. apt and dnf verify a signature over the repository index before trusting any package. trusted=yes, AllowUnauthenticated or gpgcheck=0 switches that off. Then a mirror operator or anyone on the network path can deliver modified packages (HOST-PKG-002). Third-party repositories are not wrong in themselves, but each needs an owner and a reason (HOST-PKG-003); NIST SP 800-161 treats this as supply chain risk.

Updates only help once they are in effect. Repository metadata must be refreshed on a schedule or no tool can see pending updates (HOST-PKG-006). A kernel update protects nothing until the machine boots into it (HOST-PKG-005). Every old kernel left installed stays bootable with every vulnerability it had (HOST-PKG-004). NIST SP 800-40 Rev. 4 covers this lifecycle; the checks map to CIS Controls v8 safeguard 7.4.

## Services That Came Along

A service that is installed but stopped comes back with the next upgrade or reboot and is one command away from running. HOST-SVC-001 asks what is active now. HOST-SVC-002 to 012 read the package database and the systemd boot links. They cover Telnet, the r-services and finger, TFTP, FTP, NIS, Avahi and CUPS, NFS and rpcbind. They also cover DHCP and DNS servers, Samba, SNMP and Squid, and inetd super-servers. The cleartext protocols (Telnet, rsh, TFTP, FTP, NIS) rate Medium because they send credentials or data unencrypted. The rest rate Low as attack surface with no purpose on a typical server. Where a machine legitimately runs one, the suppression file records the reason so the finding stays visible but accepted. This is NIST SP 800-123's advice to remove or disable unnecessary services, NIST SP 800-53 CM-7, and CIS Controls v8 safeguard 4.8.

## In Summary

Password policy is enforced by PAM and login.defs together, so check both. Keep root's PATH clean and expire and warn on schedule. Only install packages from signed repositories you recognise, and refresh package lists. Retire old kernels and remove the legacy services that arrived with the image.

## Apply It

- [HOST-PAM-001 Password Quality Module Not Enforced](https://openvapt.com/checks/HOST-PAM-001.md) (low)
- [HOST-PAM-002 Account Lockout Releases Too Quickly](https://openvapt.com/checks/HOST-PAM-002.md) (low)
- [HOST-PAM-003 su Not Restricted to an Administrative Group](https://openvapt.com/checks/HOST-PAM-003.md) (low)
- [HOST-PAM-004 Password History Not Enforced](https://openvapt.com/checks/HOST-PAM-004.md) (low)
- [HOST-PAM-005 Minimum Password Age Not Set](https://openvapt.com/checks/HOST-PAM-005.md) (low)
- [HOST-PAM-006 Password Expiry Warning Too Short](https://openvapt.com/checks/HOST-PAM-006.md) (info)
- [HOST-PAM-007 Inactive Accounts Never Locked](https://openvapt.com/checks/HOST-PAM-007.md) (low)
- [HOST-PAM-008 Root PATH Contains Unsafe Entries](https://openvapt.com/checks/HOST-PAM-008.md) (medium)
- [HOST-PAM-009 No Shell Idle Timeout](https://openvapt.com/checks/HOST-PAM-009.md) (low)
- [HOST-PKG-002 Repository Signature Checks Disabled](https://openvapt.com/checks/HOST-PKG-002.md) (high)
- [HOST-PKG-003 Third-Party Package Repositories Present](https://openvapt.com/checks/HOST-PKG-003.md) (info)
- [HOST-PKG-004 Many Old Kernels Retained](https://openvapt.com/checks/HOST-PKG-004.md) (low)
- [HOST-PKG-005 Running Kernel Older Than Installed Kernel](https://openvapt.com/checks/HOST-PKG-005.md) (medium)
- [HOST-PKG-006 Package Lists Not Refreshed Automatically](https://openvapt.com/checks/HOST-PKG-006.md) (low)
- [HOST-SVC-002 Telnet Server Installed or Enabled](https://openvapt.com/checks/HOST-SVC-002.md) (medium)
- [HOST-SVC-003 rsh, rlogin, rexec or finger Server Installed or Enabled](https://openvapt.com/checks/HOST-SVC-003.md) (medium)
- [HOST-SVC-004 TFTP Server Installed or Enabled](https://openvapt.com/checks/HOST-SVC-004.md) (medium)
- [HOST-SVC-005 FTP Server Installed or Enabled](https://openvapt.com/checks/HOST-SVC-005.md) (medium)
- [HOST-SVC-006 NIS Server or Client Installed or Enabled](https://openvapt.com/checks/HOST-SVC-006.md) (medium)
- [HOST-SVC-007 Avahi or CUPS Installed or Enabled](https://openvapt.com/checks/HOST-SVC-007.md) (low)
- [HOST-SVC-008 NFS Server or rpcbind Installed or Enabled](https://openvapt.com/checks/HOST-SVC-008.md) (low)
- [HOST-SVC-009 DHCP or DNS Server Installed or Enabled](https://openvapt.com/checks/HOST-SVC-009.md) (low)
- [HOST-SVC-010 Samba File Server Installed or Enabled](https://openvapt.com/checks/HOST-SVC-010.md) (low)
- [HOST-SVC-011 SNMP Agent or Squid Proxy Installed or Enabled](https://openvapt.com/checks/HOST-SVC-011.md) (low)
- [HOST-SVC-012 inetd Super-Server Installed or Enabled](https://openvapt.com/checks/HOST-SVC-012.md) (low)

## Lab

1. `Run: openvapt demo --only HOST-PAM- --out p22a  and read the common-password stacks in internal/lab/fixtures_audit_pam_pkg.go side by side.`
2. `Run: openvapt demo --only HOST-PKG- --out p22b  and find the sources.list entry that fails HOST-PKG-002 and the one listed by HOST-PKG-003.`
3. `Run: openvapt demo --only HOST-SVC- --out p22c  and, for each failed check, decide whether removing the package or disabling the unit would be the right fix on a real server.`
4. `On a test machine you own: sudo openvapt scan --only HOST-PAM-,HOST-PKG-,HOST-SVC- and compare with  grep pam_ /etc/pam.d/common-password  and  dpkg -l | grep '^ii' .`

## Check Yourself

Answer keys are public for every channel (see Teaching With OpenVAPT).

1. pwquality.conf sets minlen = 14, but /etc/pam.d/common-password has no pam_pwquality line. What is enforced?
   - A. A 14-character minimum
   - B. Nothing from pwquality: the module is never called
   - C. Only a dictionary check
   - D. A 14-character minimum for root only
   - Answer: B. PAM settings take effect only through the modules the stack actually calls.

2. Root's .bashrc sets PATH=.:/usr/bin:/bin. What can a local user do?
   - A. Nothing: . is harmless
   - B. Place a program named ls in a directory root will visit and have it run as root
   - C. Read root's files
   - D. Change root's password
   - Answer: B. A leading . (or empty element) runs programs from the current directory first.

3. A sources.list entry carries [trusted=yes]. What does apt skip for it?
   - A. Downloading the package
   - B. Verifying the repository signature
   - C. Installing dependencies
   - D. Checking free disk space
   - Answer: B. Without signature verification a tampered mirror or intercepted download installs as root.

4. telnetd is installed but systemctl says telnet.socket is inactive. Why do the HOST-SVC checks still report it?
   - A. Because active and installed are the same thing
   - B. Because an installed service comes back with the next upgrade or reboot and is one command from running
   - C. Because Telnet is encrypted
   - D. Because the socket is always active anyway
   - Answer: B. Installed-but-stopped is latent attack surface; remove what is not needed.

5. Why does an installed kernel update not protect the machine straight away?
   - A. The old kernel keeps running until the machine boots into the new one
   - B. Kernels update themselves while running
   - C. It needs a new licence first
   - D. Updates are only downloaded, never installed
   - Answer: A. A kernel update protects nothing until the machine boots into it (HOST-PKG-005).

## Key Terms

- PAM: Pluggable Authentication Modules: the Linux framework through which programs check passwords and apply rules such as lockout, quality and history, configured in /etc/pam.d.
- Password History: Remembering a user's recent password hashes so that a changed password cannot be changed straight back to an old one.
- Path Interception: Getting a privileged user to run an attacker's program by placing it in a directory that appears on their PATH before the real command, for example through a . or empty PATH entry.
- Repository Signing: The digital signature over a package repository's index that apt and dnf verify before trusting any package in it; disabling the check lets a tampered mirror install code as root.
- Legacy Service: A network service such as Telnet, rsh, TFTP or NIS that predates modern encrypted alternatives and is rarely needed, but is still packaged and easy to leave installed.
- Idle Timeout: Closing an interactive session automatically after a period without input (TMOUT in the shell), so an unattended logged-in terminal does not stay open.

## References

- [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html)
- [NIST SP 800-53 Rev. 5, IA-5, AC-7 and CM-7](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)
- [NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning](https://csrc.nist.gov/pubs/sp/800/40/r4/final)
- [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final)
- [pam.conf(5), Linux man-pages (PAM configuration)](https://man7.org/linux/man-pages/man5/pam.conf.5.html)

Offline: `openvapt learn P22`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p22.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.