Ensure password hashing algorithm is SHA-512

AltaNivel 1Automatizadaazure-container-linux

Descripción

The commands below change password encryption from md5 to sha512 (a much stronger hashing algorithm). All existing accounts will need to perform a password change to upgrade the stored hashes to the new algorithm. Note: • These changes only apply to accounts configured on the local system. • Additional module options may be set, recommendation only covers those listed here. Audit: Passes when pam_unix.so on the password stack of /etc/pam.d/system-auth and /etc/pam.d/system-password uses the sha512 option.

Cómo se verifica

Método de auditoría: Comando de shell

shell

bad=0; for p in /etc/pam.d/system-auth /etc/pam.d/system-password; do grep -Pq "^\h*password\h+([^#\n\r]+)?\h+pam_unix\.so\h+([^#\n\r]+\h+)?sha512\b" $p 2>/dev/null || bad=1; done; [ $bad -eq 0 ] && echo compliant || echo noncompliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Edit the /etc/pam.d/system-password and /etc/pam.d/system-auth files to include sha512 option and remove the md5 option for pam_unix.so: password sufficient pam_unix.so sha512 Note: • Any system accounts that need to be expired should be carefully done separately by the system administrator to prevent any potential problems. • If it is determined that the password algorithm being used is not SHA-512, once it is changed, it is recommended that all user ID's be immediately expired and forced to change their passwords on next login, In accordance with local site policies.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: azure-container-linuxpampasswords
Referencia: CIS Azure Container Linux Benchmark v1.0.0 - 5.4.3 Ensure password hashing algorithm is SHA-512

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target azure-container-linux