id: auth_pam_login_smartcard_enforce
title: Enforce Multifactor Authentication for Login
discussion: |
  The system _MUST_ be configured to enforce multifactor authentication.

  All users _MUST_ go through multifactor authentication to prevent unauthenticated access and potential compromise to the system.

  IMPORTANT: Modification of Pluggable Authentication Modules (PAM) now require user authorization, or use of a Privacy Preferences Policy Control (PPPC) profile from MDM that authorizes modifying system administrator files or full disk access.

  NOTE: /etc/pam.d/login will be automatically modified to its original state following any update or major upgrade to the operating system.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95132-7
      macos_15:
        - CCE-94132-8
      macos_14:
        - CCE-92732-7
    800-53r5:
      - IA-2(1)
      - IA-2(2)
      - IA-2(8)
    800-171r3:
      - 03.05.03
      - 03.05.04
  disa:
    cci:
      - CCI-000765
      - CCI-000766
      - CCI-000767
      - CCI-000768
      - CCI-001941
      - CCI-004047
    srg:
      - SRG-OS-000107-GPOS-00054
      - SRG-OS-000112-GPOS-00057
      - SRG-OS-000108-GPOS-00055
      - SRG-OS-000106-GPOS-00053
      - SRG-OS-000105-GPOS-00052
      - SRG-OS-000705-GPOS-00150
    disa_stig:
      macos_26:
        - APPL-26-003050
      macos_15:
        - APPL-15-003050
      macos_14:
        - APPL-14-003050
    cmmc:
      - IA.L2-3.5.3
      - IA.L2-3.5.4
  hhs:
    hicp:
      - 3.L.A
      - 3.L.B
  cis:
    controls_v8:
      - 6.3
      - 6.4
      - 6.5
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: disa_stig
          severity: medium
    '15.0':
      benchmarks:
        - name: disa_stig
          severity: medium
    enforcement_info:
      check:
        shell: |-
          if [[ -d /var/db/ManagedConfigurationFiles/com.apple.pam ]]; then
            /usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /var/db/ManagedConfigurationFiles/com.apple.pam/etc/pam.d/login
          else
            /usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login
          fi
        result:
          integer: 2
      fix:
        shell: |-
          /bin/cat > /etc/pam.d/login << LOGIN_END
          # login: auth account password session
          auth        sufficient    pam_smartcard.so
          auth        optional      pam_krb5.so use_kcminit
          auth        optional      pam_ntlm.so try_first_pass
          auth        optional      pam_mount.so try_first_pass
          auth        required      pam_opendirectory.so try_first_pass
          auth        required      pam_deny.so
          account     required      pam_nologin.so
          account     required      pam_opendirectory.so
          password    required      pam_opendirectory.so
          session     required      pam_launchd.so
          session     required      pam_uwtmp.so
          session     optional      pam_mount.so
          LOGIN_END


          /bin/chmod 644 /etc/pam.d/login
          /usr/sbin/chown root:wheel /etc/pam.d/login
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-171
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cnssi-1253_moderate
  - hicp_lp
ddm_info:
  declarationtype: com.apple.configuration.services.configuration-files
  service: com.apple.pam
  config_file: login
  configuration_key: file
  configuration_value: |-
    auth        sufficient    pam_smartcard.so
    auth        optional      pam_krb5.so use_kcminit
    auth        optional      pam_ntlm.so try_first_pass
    auth        optional      pam_mount.so try_first_pass
    auth        required      pam_opendirectory.so try_first_pass
    auth        required      pam_deny.so
    account     required      pam_nologin.so
    account     required      pam_opendirectory.so
    password    required      pam_opendirectory.so
    session     required      pam_launchd.so
    session     required      pam_uwtmp.so
    session     optional      pam_mount.so
