Ensure password dictionary check is enabled

점검 방법

감사 방식: 셸 명령

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -Psi -- '"'"'^\h*dictcheck\h*=\h*0\b'"'"' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; o=$(bash -c 'grep -Psi -- '"'"'^\h*password\h+(requisite|required|sufficient)\h+pam_pwquality\.so\h+([^#\n r]+\h+)?dictcheck\h*=\h*0\b'"'"' /etc/pam.d/system-auth /etc/pam.d/password-auth' 2>/dev/null); [ -z "$o" ] || { echo "step2: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

예상 출력

compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Edit any file ending in .conf in the /etc/security/pwquality.conf.d/ directory and/or the file /etc/security/pwquality.conf and comment out or remove any instance of dictcheck = 0: Example: # sed -ri 's/^\s*dictcheck\s*=/# &/' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf Run the following script to remove setting dictcheck on the pam_pwquality.so module in the PAM files: #!/usr/bin/env bash { for l_pam_file in system-auth password-auth; do l_authselect_file="/etc/authselect/$(head -1 /etc/authselect/authselect.conf | grep 'custom/')/$l_pam_file" sed -ri 's/(^\s*password\s+(requisite|required|sufficient)\s+pam_pwquality\.so.*)(\s+ dictcheck\s*=\s*\S+)(.*$)/\1\4/' "$l_aut…

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

tmaegis scan --target linux