Ensure password creation requirements are configured

HochStufe 1Automatisiertazure-container-linux

Beschreibung

The pam_pwquality.so module checks the strength of passwords. It performs checks such as making sure a password is not a dictionary word, it is a certain length, contains a mix of characters (e.g. alphabet, numeric, other) and more. The following are definitions of the pam_pwquality.so options. The following options are set in the /etc/security/pwquality.conf file: Password Length: • minlen = 14 - password must be 14 characters or more Password complexity: • minclass = 4 - The minimum number of required classes of characters for the new password (digits, uppercase, lowercase, others) -OR- • dcredit = -1 - provide at least one digit • ucredit = -1 - provide at least one uppercase character • ... Audit: Passes when /etc/security/pwquality.conf sets minlen to 14 or more, sets minclass=4 or all four dcredit/ucredit/lcredit/ocredit to negative values, and pam_pwquality has retry=1..3 in /etc/pam.d/system-password and /etc/pam.d/system-auth.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

q=/etc/security/pwquality.conf; [ -r $q ] || exit 1; bad=0; v=$(awk -F= '/^[[:space:]]*minlen[[:space:]]*=/{gsub(/[[:space:]]/,"",$2);print $2}' $q | tail -1); [ -n "$v" ] && [ "$v" -ge 14 ] || bad=1; c=$(awk -F= '/^[[:space:]]*minclass[[:space:]]*=/{gsub(/[[:space:]]/,"",$2);print $2}' $q | tail -1); if [ "${c:-0}" -ne 4 ]; then for k in dcredit ucredit lcredit ocredit; do x=$(awk -F= -v k=$k '$1 ~ "^[[:space:]]*"k"[[:space:]]*$"{gsub(/[[:space:]]/,"",$2);print $2}' $q | tail -1); [ -n "$x" ] && [ "$x" -lt 0 ] || bad=1; done; fi; for p in /etc/pam.d/system-password /etc/pam.d/system-auth; do grep -Pq "^\h*password\h+([^#\n\r]+\h+)?pam_pwquality\.so\h+([^#\n\r]+\h+)?retry=[1-3]\b" $p 2>/dev/null || bad=1; done; [ $bad -eq 0 ] && echo compliant || echo noncompliant

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Edit the file /etc/security/pwquality.conf and add or modify the following line for password length to conform to site policy: minlen = 14 Edit the file /etc/security/pwquality.conf and add or modify the following line for password complexity to conform to site policy: minclass = 4 -OR- dcredit = -1 ucredit = -1 ocredit = -1 lcredit = -1 Edit the /etc/pam.d/system-password and /etc/pam.d/system-auth files to include the appropriate options for pam_pwquality.so and to conform to site policy: password requisite pam_pwquality.so retry=3

Eigenschaften

Betriebssysteme: Beliebig
Tags: azure-container-linuxpampasswords
Referenz: CIS Azure Container Linux Benchmark v1.0.0 - 5.4.1 Ensure password creation requirements are configured

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target azure-container-linux