CompTIA Linux+ XK0-006 (V8) Practice Question

The correct solution is to implement a Pluggable Authentication Module (PAM) that checks passwords against a known breach list. Several PAM modules, such as pam_pwned, are designed for this exact purpose. They integrate with the Linux authentication system and can be configured to query a service like 'Have I Been Pwned?' or use a downloaded list to reject compromised passwords during the password-change process.

• Using pam_tally2 is incorrect because it is used to lock accounts after a specific number of failed login attempts, not to validate password content against breach lists.
• Enforcing password complexity and history with pam_pwhistory or chage is a valuable security practice but does not check if a password has been part of a known breach.
• A cron job running a password cracker like john checks for weak, guessable passwords within the system's own shadow file but does not compare them against extensive external breach databases.