Skip to content

5.1.22 Ensure sshd UsePAM is enabled

Audit#

Run the following command to verify UsePAM is set to yes: 

# sshd -T | grep -i usepam
usepam yes

Remediation#

Edit the /etc/ssh/sshd_config file to set the UsePAM parameter to yes above any Include entries as follows: 

UsePAM yes
Note: First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.

Default Value: UsePAM yes