Ensure password hashing algorithm is SHA-512

高レベル 1自動azure-container-linux

説明

The commands below change password encryption from md5 to sha512 (a much stronger hashing algorithm). All existing accounts will need to perform a password change to upgrade the stored hashes to the new algorithm. Note: • These changes only apply to accounts configured on the local system. • Additional module options may be set, recommendation only covers those listed here. Audit: Passes when pam_unix.so on the password stack of /etc/pam.d/system-auth and /etc/pam.d/system-password uses the sha512 option.

チェック方法

監査方法: シェルコマンド

shell

bad=0; for p in /etc/pam.d/system-auth /etc/pam.d/system-password; do grep -Pq "^\h*password\h+([^#\n\r]+)?\h+pam_unix\.so\h+([^#\n\r]+\h+)?sha512\b" $p 2>/dev/null || bad=1; done; [ $bad -eq 0 ] && echo compliant || echo noncompliant

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Edit the /etc/pam.d/system-password and /etc/pam.d/system-auth files to include sha512 option and remove the md5 option for pam_unix.so: password sufficient pam_unix.so sha512 Note: • Any system accounts that need to be expired should be carefully done separately by the system administrator to prevent any potential problems. • If it is determined that the password algorithm being used is not SHA-512, once it is changed, it is recommended that all user ID's be immediately expired and forced to change their passwords on next login, In accordance with local site policies.

プロパティ

オペレーティングシステム: すべて
タグ: azure-container-linuxpampasswords
参照: CIS Azure Container Linux Benchmark v1.0.0 - 5.4.3 Ensure password hashing algorithm is SHA-512

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target azure-container-linux