Ensure password hashing algorithm is SHA-512

TinggiLevel 1Otomatisazure-container-linux

Deskripsi

The commands below change password encryption from md5 to sha512 (a much stronger hashing algorithm). All existing accounts will need to perform a password change to upgrade the stored hashes to the new algorithm. Note: • These changes only apply to accounts configured on the local system. • Additional module options may be set, recommendation only covers those listed here. Audit: Passes when pam_unix.so on the password stack of /etc/pam.d/system-auth and /etc/pam.d/system-password uses the sha512 option.

Cara pemeriksaan

Metode audit: Perintah shell

shell

bad=0; for p in /etc/pam.d/system-auth /etc/pam.d/system-password; do grep -Pq "^\h*password\h+([^#\n\r]+)?\h+pam_unix\.so\h+([^#\n\r]+\h+)?sha512\b" $p 2>/dev/null || bad=1; done; [ $bad -eq 0 ] && echo compliant || echo noncompliant

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Edit the /etc/pam.d/system-password and /etc/pam.d/system-auth files to include sha512 option and remove the md5 option for pam_unix.so: password sufficient pam_unix.so sha512 Note: • Any system accounts that need to be expired should be carefully done separately by the system administrator to prevent any potential problems. • If it is determined that the password algorithm being used is not SHA-512, once it is changed, it is recommended that all user ID's be immediately expired and forced to change their passwords on next login, In accordance with local site policies.

Properti

Sistem operasi: Apa saja
Tag: azure-container-linuxpampasswords
Referensi: CIS Azure Container Linux Benchmark v1.0.0 - 5.4.3 Ensure password hashing algorithm is SHA-512

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target azure-container-linux