common: Disable empty password authentication via authselect without-nullok#255
common: Disable empty password authentication via authselect without-nullok#255sebrandon1 wants to merge 1 commit into
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: sebrandon1 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @sebrandon1. Thanks for your PR. I'm waiting for a coreos member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request enhances security by incorporating the without-nullok feature into the authselect configuration, which disables empty password authentication. It also introduces a verification step to ensure the nullok option is successfully removed from PAM files. The review feedback suggests extending this verification to include smartcard-auth and fingerprint-auth to ensure consistent security policy enforcement across all relevant authentication methods.
…nullok Add the without-nullok feature flag to the existing authselect test sssd calls, removing the nullok parameter from PAM pam_unix.so in all auth files. This prevents authentication with empty passwords on RHCOS nodes. This is a HIGH severity finding across every compliance profile that applies to RHCOS (Essential 8, CIS, NIST Moderate, and PCI-DSS).
sebrandon1
force-pushed
the
hardening/pam-no-empty-passwords
branch
from
40cde78 to
ce795bc
Compare
1 participant
RHCOS inherits
nullokin PAM from the RHEL defaults, which permits authentication with empty passwords. While RHCOS nodes don't set a root password by default,nullokstill allows authentication with empty passwords for any account where one is explicitly set. Removing it is a defense-in-depth measure consistent with all major compliance profiles.This adds
without-nullokto the existingauthselect test sssdcalls in the postprocess block, plus a verification step. The change is minimal — adding one authselect feature flag to the existing PAM configuration step.Why this change
This is flagged as a HIGH severity finding across every compliance profile that applies to RHCOS: Essential 8, CIS, NIST Moderate, and PCI-DSS. Unlike many hardening recommendations where benchmarks disagree, removing
nullokis consistent across all of them.Today, the compliance-operator remediation for this finding is broken on RHCOS 9 — it generates RHEL 8 era PAM templates that don't apply cleanly. Fixing it at the image level eliminates the issue for all clusters without requiring per-node MachineConfig remediation.
Why the maintenance burden is low
without-nullokfeature flag — the supported RHEL mechanism purpose-built for this (authselect/authselect#94, landed in 2018)authselect test sssdcalls — no new postprocess block, no custom PAM filesScope
This is intentionally narrow. We understand the concern about carrying hardening overrides that diverge from RHEL defaults. This is not a campaign to upstream every compliance checklist item.
Moved from openshift/os#1934 per maintainer feedback.
References
without-nullokfeature: authselect/authselect@e1fbbdc