Azure Container Linux
TMA-AZURE-CONTAINER-LINUX-5.4.3
Ensure password hashing algorithm is SHA-512
Beschreibung
The commands below change password encryption from md5 to sha512 (a much stronger hashing algorithm). All existing accounts will need to perform a password change to upgrade the stored hashes to the new algorithm. Note: • These changes only apply to accounts configured on the local system. • Additional module options may be set, recommendation only covers those listed here. Audit: Passes when pam_unix.so on the password stack of /etc/pam.d/system-auth and /etc/pam.d/system-password uses the sha512 option.
So wird geprüft
Prüfmethode: Shell-Befehl
bad=0; for p in /etc/pam.d/system-auth /etc/pam.d/system-password; do grep -Pq "^\h*password\h+([^#\n\r]+)?\h+pam_unix\.so\h+([^#\n\r]+\h+)?sha512\b" $p 2>/dev/null || bad=1; done; [ $bad -eq 0 ] && echo compliant || echo noncompliant- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Edit the /etc/pam.d/system-password and /etc/pam.d/system-auth files to include sha512 option and remove the md5 option for pam_unix.so: password sufficient pam_unix.so sha512 Note: • Any system accounts that need to be expired should be carefully done separately by the system administrator to prevent any potential problems. • If it is determined that the password algorithm being used is not SHA-512, once it is changed, it is recommended that all user ID's be immediately expired and forced to change their passwords on next login, In accordance with local site policies.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- azure-container-linuxpampasswords
- Referenz
- CIS Azure Container Linux Benchmark v1.0.0 - 5.4.3 Ensure password hashing algorithm is SHA-512
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target azure-container-linux