Ensure password creation requirements are configured

높음레벨 1자동azure-container-linux

설명

The pam_pwquality.so module checks the strength of passwords. It performs checks such as making sure a password is not a dictionary word, it is a certain length, contains a mix of characters (e.g. alphabet, numeric, other) and more. The following are definitions of the pam_pwquality.so options. The following options are set in the /etc/security/pwquality.conf file: Password Length: • minlen = 14 - password must be 14 characters or more Password complexity: • minclass = 4 - The minimum number of required classes of characters for the new password (digits, uppercase, lowercase, others) -OR- • dcredit = -1 - provide at least one digit • ucredit = -1 - provide at least one uppercase character • ... Audit: Passes when /etc/security/pwquality.conf sets minlen to 14 or more, sets minclass=4 or all four dcredit/ucredit/lcredit/ocredit to negative values, and pam_pwquality has retry=1..3 in /etc/pam.d/system-password and /etc/pam.d/system-auth.

점검 방법

감사 방식: 셸 명령

shell

q=/etc/security/pwquality.conf; [ -r $q ] || exit 1; bad=0; v=$(awk -F= '/^[[:space:]]*minlen[[:space:]]*=/{gsub(/[[:space:]]/,"",$2);print $2}' $q | tail -1); [ -n "$v" ] && [ "$v" -ge 14 ] || bad=1; c=$(awk -F= '/^[[:space:]]*minclass[[:space:]]*=/{gsub(/[[:space:]]/,"",$2);print $2}' $q | tail -1); if [ "${c:-0}" -ne 4 ]; then for k in dcredit ucredit lcredit ocredit; do x=$(awk -F= -v k=$k '$1 ~ "^[[:space:]]*"k"[[:space:]]*$"{gsub(/[[:space:]]/,"",$2);print $2}' $q | tail -1); [ -n "$x" ] && [ "$x" -lt 0 ] || bad=1; done; fi; for p in /etc/pam.d/system-password /etc/pam.d/system-auth; do grep -Pq "^\h*password\h+([^#\n\r]+\h+)?pam_pwquality\.so\h+([^#\n\r]+\h+)?retry=[1-3]\b" $p 2>/dev/null || bad=1; done; [ $bad -eq 0 ] && echo compliant || echo noncompliant

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Edit the file /etc/security/pwquality.conf and add or modify the following line for password length to conform to site policy: minlen = 14 Edit the file /etc/security/pwquality.conf and add or modify the following line for password complexity to conform to site policy: minclass = 4 -OR- dcredit = -1 ucredit = -1 ocredit = -1 lcredit = -1 Edit the /etc/pam.d/system-password and /etc/pam.d/system-auth files to include the appropriate options for pam_pwquality.so and to conform to site policy: password requisite pam_pwquality.so retry=3

속성

운영 체제: 모두
태그: azure-container-linuxpampasswords
참고 자료: CIS Azure Container Linux Benchmark v1.0.0 - 5.4.1 Ensure password creation requirements are configured

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target azure-container-linux