TMA-GITLAB-2.1.9
Ensure default passwords are not used
설명
Do not use default passwords of build tools and components. Sometimes build tools and components are provided with default passwords for the first login. This password is intended to be used only on the first login and should be changed immediately after. Using the default password substantially increases the attack risk. It is especially important to ensure that default passwords are not used in build tools and components.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
GitLab’s default root password depends on the installation method, and when the installation occurred: 1. When deploying a GitLab instance using the official AWS AMI, the root password to the instance is the EC2 Instance ID 2. Most installation methods allow a non-default password to be provided as configuration 3. Prior to 14.0 the default password was 5iveL!fe 4. Otherwise the default password is unique and randomly generated. Attempt to log in as root using a suspected default password to audit whether it has changed. For any other external build tools, ensure the password used is not the default one.
조치 방법
조치 방식: 가이드 또는 인프라 패치
GitLab’s root password can be changed by an administrator using the UI, the “gitlab:password:reset” rake task, or by using the Rails console. For each build tool with a default password, change to a unique cryptographically secure pseudorandom password.
속성
- 운영 체제
- 모두
- 태그
- authdevsecopsgitlab
- 참고 자료
- CIS GitLab Benchmark v1.0.1 - 2.1.9 Ensure default passwords are not used