Install pam-modules Package
Ensures the libpam-modules package (core PAM modules) is installed so PAM-based hardening can be enforced.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
libpam-modules ships the core PAM modules (pam_unix, pam_pwquality, pam_faillock, pam_pwhistory…) that many other hardening rules rely on to enforce password quality, account lockout and history. If the package is missing, those PAM-based controls cannot be configured at all, leaving authentication policy unenforced.
What Pavois checks
Pavois queries the package database via InSpec package('libpam-modules') (dpkg -s libpam-modules) and asserts it is installed. Confirming the package is present guarantees the shared objects (pam_*.so) that other rules wire into /etc/pam.d/ actually exist on disk.
describe package('libpam-modules') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -s libpam-modules. The expected output includes Status: install ok installed. Anything else means the rule fails.
Inspect & investigate
Confirm installation via apt list --installed | grep libpam-modules or /var/log/apt/history.log. The PAM modules themselves emit authentication events to /var/log/auth.log (e.g. pam_unix(...), pam_faillock) and to journalctl.
Remediation
Pavois's harden plan declares a package resource named libpam-modules with action install; pavois harden apply runs the equivalent of apt-get install libpam-modules to reach the compliant state. It is normally already present as an essential dependency.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | libpam-modules |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
This is a foundational package (essential on Debian/Ubuntu); installing it is safe and usually a no-op. Precaution: never attempt to remove libpam-modules, doing so would break PAM and could render the system unable to authenticate any user, including root, effectively bricking login. Installing or reinstalling it has no adverse effect.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.3.1.2 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.