harden.yml
harden.yml copied to clipboard
PAM: Should nullok removed from password also?
To disable the
nullok
option, remove thenullok
string from configuration files in the/etc/pam.d/
directory, such as/etc/pam.d/system-auth
or/etc/pam.d/password-auth
.
The argument
nullok
instructs the module to allow the user to change their password from a blank password, otherwise a null password is treated as an account lock.
PAM_UNIX(8)
has an example with password
:
password required pam_unix.so use_authtok nullok yescrypt
https://github.com/linux-pam/linux-pam/blob/cf2fc5ff7b4a8555fda2a5ebe5f6ab0e45c22996/modules/pam_unix/pam_unix_passwd.c#L562-L564 complains that "No password has been supplied."