Ensure pam_unix does not include remember

中レベル 1自動linux

説明

The remember=n argument saves the last n passwords for each user in /etc/security/opasswd in order to force password change history and keep the user from alternating between the same password too frequently. The MD5 password hash algorithm is used for storing the old passwords. Instead of this option the pam_pwhistory module should be used. The pam_pwhistory module saves the last n passwords for each user in /etc/security/opasswd using the password hash algorithm set on the pam_unix module. This allows for the sha512 hash algorithm to be used.

チェック方法

監査方法: シェルコマンド

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -Pi -- '"'"'^\h*password\h+([^#\n\r]+\h+)?pam_unix\.so\h+([^#\n\r]+\h+)?remember='"'"' /etc/pam.d/system-auth /etc/pam.d/password-auth' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

The pam_unix arguments are set on the pam_unix.so module lines in the active authselect profile; editing /etc/pam.d/system-auth or /etc/pam.d/password-auth directly is not durable, because authselect regenerates those files (see the section overview for the authselect profile model). Remove the remember argument so password history is handled by pam_pwhistory rather than pam_unix: 1. Ensure the system is using a custom authselect profile. If it is still on a stock profile, create and select one first, as described in the section overview. 2. On the pam_unix.so lines in the active custom profile templates (/etc/authselect/custom/<profile>/system-auth and /etc/authselect/custom/<profile>/passw…

プロパティ

オペレーティングシステム: almalinux-9
タグ: cis-convertedlinux
参照: CIS AlmaLinux OS 9 Benchmark v3.0.0 - 5.3.3.4.2

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target linux