id: auth_pam_login_smartcard_enforce
title: Enforce Multifactor Authentication for Login
discussion: |
  The system _MUST_ be configured to enforce multifactor authentication.

  All users _MUST_ go through multifactor authentication to prevent unauthenticated access and potential compromise to the system.

  IMPORTANT: Modification of Pluggable Authentication Modules (PAM) now require user authorization, or use of a Privacy Preferences Policy Control (PPPC) profile from MDM that authorizes modifying system administrator files or full disk access.

  NOTE: /etc/pam.d/login will be automatically modified to its original state following any update or major upgrade to the operating system.
check: |
  /usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login
result:
  integer: 2
fix: |
  [source,bash]
  ----
  /bin/cat > /etc/pam.d/login << LOGIN_END
  # login: auth account password session
  auth        sufficient    pam_smartcard.so
  auth        optional      pam_krb5.so use_kcminit
  auth        optional      pam_ntlm.so try_first_pass
  auth        optional      pam_mount.so try_first_pass
  auth        required      pam_opendirectory.so try_first_pass
  auth        required      pam_deny.so
  account     required      pam_nologin.so
  account     required      pam_opendirectory.so
  password    required      pam_opendirectory.so
  session     required      pam_launchd.so
  session     required      pam_uwtmp.so
  session     optional      pam_mount.so
  LOGIN_END


  /bin/chmod 644 /etc/pam.d/login
  /usr/sbin/chown root:wheel /etc/pam.d/login
  ----
references:
  cce:
    - CCE-95132-7
  cci:
    - CCI-000765
    - CCI-000766
    - CCI-000767
    - CCI-000768
    - CCI-001941
    - CCI-004047
  800-53r5:
    - IA-2(1)
    - IA-2(2)
    - IA-2(8)
  800-53r4:
    - IA-2(3)
    - IA-2(4)
    - IA-5(11)
  srg:
    - SRG-OS-000107-GPOS-00054
    - SRG-OS-000112-GPOS-00057
    - SRG-OS-000108-GPOS-00055
    - SRG-OS-000106-GPOS-00053
    - SRG-OS-000105-GPOS-00052
    - SRG-OS-000705-GPOS-00150
  disa_stig:
    - APPL-26-003050
  800-171r3:
    - 03.05.03
    - 03.05.04
  cis:
    benchmark:
      - N/A
    controls v8:
      - 6.3
      - 6.4
      - 6.5
  cmmc:
    - IA.L2-3.5.3
    - IA.L2-3.5.4
macOS:
  - '26.0'
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-53r4_low
  - 800-53r4_moderate
  - 800-53r4_high
  - 800-171
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - stig
  - cnssi-1253_moderate
severity: medium
mobileconfig: false
mobileconfig_info:
ddm_info:
  declarationtype: com.apple.configuration.services.configuration-files
  service: com.apple.pam
  config_file: login
  configuration_key: file
  configuration_value: |
    auth        sufficient    pam_smartcard.so
    auth        optional      pam_krb5.so use_kcminit
    auth        optional      pam_ntlm.so try_first_pass
    auth        optional      pam_mount.so try_first_pass
    auth        required      pam_opendirectory.so try_first_pass
    auth        required      pam_deny.so
    account     required      pam_nologin.so
    account     required      pam_opendirectory.so
    password    required      pam_opendirectory.so
    session     required      pam_launchd.so
    session     required      pam_uwtmp.so
    session     optional      pam_mount.so