UsePAM should probably default to yes on Red Hat Linux 7

[elyscape]

From the sshd_config file on a CentOS 7 box:

# WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
# problems.

As such, it's probably a good idea to default ssh_use_pam to true on RedHat 7.

This warning isn't in the CentOS 6 sshd_config file, but there is an article in the Red Hat 6 knowledgebase about not being able to SSH into a system if UsePAM is off and SELinux is on. I don't have an account and can't see the solution, though, so there might be a way to deal with that.

See also dev-sec/puppet-ssh-hardening#53 and dev-sec/chef-ssh-hardening#96.

[rndmh3ro]

The workaround mentioned by RedHat is:
The workaround would be to create an additional policy that allow sshd to read password file directly

We could create that policy and add it to selinux, when use_pam is off and selinux is on.
Does this happen on all OS's?

@chris-rock What do you think?
Sounds like a good alternative.

[rndmh3ro]

As per dev-sec/chef-ssh-hardening#96:

• to keep usepam=no and the described selinux idea in this cookbook version
• to go to usepam=yes in the next major version to have consistency, here I would suggest to take the selinux idea and to provide support for usepam=no (to allow transitions and upgrades and not to break it completely)