Install pam Package
Ensures the pam package (Pluggable Authentication Modules framework) is installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The pam package provides Pluggable Authentication Modules, the framework that authenticates users for nearly every login path (console, SSH, sudo, su, cron). PAM gives a flexible, centralized way to manage authentication, password complexity, account lockout and session policies. Keeping pam installed (and current) is the foundation on which all other authentication-hardening controls (pam_pwquality, pam_faillock, etc.) depend, and ensures the latest security fixes are applied.
What Pavois checks
Pavois asks the package manager whether pam is installed via the InSpec package resource (effectively rpm -q pam). Querying installed-package state directly confirms the PAM libraries and modules are present, rather than inferring it from the existence of files under /etc/pam.d/.
describe package('pam') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q pam. The expected output is a versioned package name such as pam-1.3.x-.... The configuration stack lives under /etc/pam.d/.
Inspect & investigate
rpm -q pam, confirms the package is installed.rpm -qi pam, shows install date and source repository.journalctl -t sshd -t sudo, PAM authentication outcomes surface in these service logs.
Remediation
Pavois's harden plan declares a package resource for pam with action install and applies it with pavois harden apply, which runs dnf install pam under the hood. In practice pam is a core dependency that is almost always already present; this control guards against accidental removal.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | pam |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
pam is a core component, installing or reinstalling it is safe and expected. Precaution: never remove PAM, as doing so would break authentication for every login path and can render the system unbootable/unloginable. When updating, avoid editing /etc/pam.d/ stacks live without a tested fallback (a root shell already open) to recover from a broken stack.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.3.1.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.