openstack/ansible-hardening
Code Issues Proposed changes
Files
770b2ad86e5e188ea2fd415ef7a6f8e418bb315a
ansible-hardening/doc/metadata/rhel7/RHEL-07-010260.rst
Major Hayden de92fbd7e0 [Docs] Fix indentation for bullets 
Change-Id: I54545dd285a37c89a60b72f19d9878edf952a56f
2016-10-31 13:32:04 -05:00

542 B
Raw Blame History

---id: RHEL-07-010260 status: implemented tag: auth ---

The Ansible tasks will ensure that PAM is configured to disallow logins from accounts with null or blank passwords. This involves removing a single option from one of the PAM configuration files:

  • CentOS or RHEL: removes nullok from /etc/pam.d/system-auth
  • Ubuntu: removes nullok_secure from /etc/pam.d/common-auth

Deployers can opt-out of this change by setting the following Ansible variable:

security_disallow_blank_password_login: no