Ensure password reuse is limited

점검 방법

감사 방식: 셸 명령

bad=0; for p in /etc/pam.d/system-password /etc/pam.d/system-auth; do grep -Pq "^\h*password\h+[^#\n\r]+\h+pam_pwhistory\.so\h+([^#\n\r]+\h+)?remember=([5-9]|[1-9][0-9]+)\b" $p 2>/dev/null || bad=1; done; [ $bad -eq 0 ] && echo compliant || echo noncompliant

예상 출력

compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Edit both the /etc/pam.d/system-password and /etc/pam.d/system-auth files to include the remember option and conform to site policy as shown: Note: Add or modify the line containing the pam_pwhistory.so after the first occurrence of password requisite: password requisite pam_pwhistory.so remember=5 Example: (Second line is modified) password requisite pam_pwquality.so try_first_pass local_users_only authtok_type= password requisite pam_pwhistory.so use_authtok remember=5 retry=3 password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok password required pam_deny.so

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

tmaegis scan --target azure-container-linux