Install pam-runtime Package
Ensures the libpam-runtime package (PAM common-* config and pam-auth-update) is installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
libpam-runtime provides the runtime PAM configuration framework, the pam-auth-update tool and the /etc/pam.d/common-* files (common-auth, common-password, common-account, common-session), that many other hardening rules edit to enforce authentication policy. Without it, the common PAM stacks do not exist and PAM-based controls cannot be configured.
What Pavois checks
Pavois queries the package database via InSpec package('libpam-runtime') (dpkg -s libpam-runtime) and asserts it is installed. Confirming the package guarantees the /etc/pam.d/common-* files and pam-auth-update framework that other rules depend on are actually present.
describe package('libpam-runtime') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -s libpam-runtime. The expected output includes Status: install ok installed. Anything else means the rule fails.
Inspect & investigate
Confirm installation via apt list --installed | grep libpam-runtime or /var/log/apt/history.log. Changes applied through pam-auth-update reshape /etc/pam.d/common-*; resulting authentication events are logged in /var/log/auth.log and journalctl.
Remediation
Pavois's harden plan declares a package resource named libpam-runtime with action install; pavois harden apply runs the equivalent of apt-get install libpam-runtime to reach the compliant state. It is normally already present as an essential dependency.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | libpam-runtime |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
This is a foundational package; installing it is safe and usually a no-op. Precaution: never remove libpam-runtime, deleting the common-* stacks would break the PAM configuration shared by login, sudo and SSH, potentially making the system unable to authenticate any user and causing lockout. Installing or reinstalling it has no adverse effect.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.3.1.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.