HIGH RHCOS (Node) H2: PAM Empty Passwords P1

Verified Compare Branch Scanned: 2026-07-01

FAIL on vanilla RHCOS 9.8. Remediation tested and works. Branch pending.

Overview

This remediation disables the nullok option in PAM (Pluggable Authentication Modules) configuration, preventing authentication with empty passwords.

Settings

Setting	Description
`no-empty-passwords`	Disable `nullok` in PAM system-auth and password-auth

Implementation

The remediation applies a MachineConfig that modifies PAM configuration files to remove the nullok option:

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  name: 75-pam-auth-high
  labels:
    machineconfiguration.openshift.io/role: master
spec:
  config:
    ignition:
      version: 3.2.0
    storage:
      files:
        - path: /etc/pam.d/system-auth
          mode: 0644
          overwrite: true
          contents:
            source: data:text/plain;charset=utf-8;base64,...
        - path: /etc/pam.d/password-auth
          mode: 0644
          overwrite: true
          contents:
            source: data:text/plain;charset=utf-8;base64,...

The PAM files are configured to require proper authentication without allowing empty passwords.

Compliance Checks Remediated

This group addresses the following compliance checks:

Check	Profile	Description	Docs
`rhcos4-e8-worker-no-empty-passwords`	E8	Prevent empty password authentication (worker)	📖
`rhcos4-e8-master-no-empty-passwords`	E8	Prevent empty password authentication (master)	📖

Source Remediation Files

high/rhcos4-e8-worker-no-empty-passwords.yaml
high/rhcos4-e8-master-no-empty-passwords.yaml

Verification

After applying the MachineConfig, verify PAM configuration on a node:

oc debug node/<node-name> -- chroot /host grep nullok /etc/pam.d/system-auth /etc/pam.d/password-auth
# Expected: No output (nullok should not be present)

Security Impact

Disabling empty passwords ensures that:

All user accounts must have a password set
SSH and console logins require proper authentication
Compliance with CIS and Essential Eight security benchmarks

Upstream Proposal

The following changes could eliminate the need for MachineConfig remediation. Items are categorized by recommended scope:

Fix no_empty_passwords remediation for RHCOS 9 All OCP Low

ComplianceAsCode/content Upstream remediation fix (PR #14602)

Compliance operator's own remediation uses broken authselect path on RHCOS 9. Upstream fix uses direct sed instead.
Scope: Empty passwords should never be allowed on any OCP node. This is a security bug, not a hardening choice.

Remove nullok from PAM in RHCOS base image All OCP Low

coreos/rhel-coreos-config packages-openshift.yaml (authselect without-nullok postprocess) View Proposed Change

RHCOS ships with nullok in PAM, allowing empty password login. Should be removed in the base image so remediation is unnecessary.
Scope: Empty passwords should never be allowed on any OCP node. This is a security bug, not a hardening choice.

PR History

Fix no_empty_passwords remediation for RHCOS 9 Open

ComplianceAsCode/content#14602 opened 2026-04-28

Remove nullok from PAM in RHCOS base image Closed redirected

openshift/os#1934 opened 2026-05-11, closed 2026-05-12

Maintainer (@travier) directed change to base layer (coreos/rhel-coreos-config) instead of openshift/os. OS-level config belongs in the base image.

Remove nullok from PAM in RHCOS base image Open

coreos/rhel-coreos-config#255 opened 2026-05-12

← H1 All Groups H3 →