Configure authentication rules with PAM
You can use a pluggable authentication module (PAM) to set authentication rules. To configure PAM settings, specify control values in Hiera.
For example, assume that you want to enforce a minimum length of 30 characters for
passwords. Because you are implementing the CIS Oracle Linux 8 Benchmark 2.0.0, you go to the Reference and look for the
relevant control in that benchmark. The control is 5.5.1, “Ensure password creation
requirements are configured,” which specifies a default minimum password length of
14. On the minlen
parameter, you replace the default
value of 14 with a new value of 30, as shown in the
example:
sce_linux::config: control_configs: "Ensure password creation requirements are configured": manage_pwquality: true manage_pam_auth: true minlen: 30 minclass: 4 faillock_args: ["preauth", "silent", "audit", "deny=5", "unlock_time=900"] pwhistory_args: ["use_authtok", "remember=5", "retry=3"]