OpenControls Logo

STIG Viewer

STIGViewer Support

AlmaLinux OS 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-269420ALMA-09-040390SV-269420r1050303_ruleCCI-000877high
Description
When UsePAM is set to "yes", PAM runs through account and session types properly. This is important when restricted access to services based off of IP, time, or other factors of the account is needed. Additionally, this ensures users can inherit certain environment variables on login or disallow access to the server.
STIGDate
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide2026-05-22

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MNT-05Remote Maintenance
0.50
MNT-05.1Auditing Remote Maintenance
0.50
MNT-05.2Remote Maintenance Notifications
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (44) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(4)Discretionary Access Control
1.00
AC-7Unsuccessful Logon Attempts
1.00

+34 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.7.5
1.00
CCI1 mapping
CCI-000877
1.00

Details

Check Text (C-269420r1050303_chk)

Verify the AlmaLinux OS 9 SSHD is configured to allow for the UsePAM interface with the following command: $ sshd -T | grep usepam usepam yes If the "UsePAM" keyword is set to "no", is missing, or is commented out, this is a finding.

Fix Text (F-73352r1048637_fix)

Configure the SSH daemon to use PAM. Add the following line to "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes": UsePAM yes Alternatively, add the setting to an include file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file: $ cat << EOF | tee /etc/ssh/sshd_config.d/pam.conf UsePAM yes EOF Restart the SSH daemon for the settings to take effect: $ systemctl restart sshd.service