Ensure pam_unix includes a strong password hashing algorithm

Como é verificado

Método de auditoria: Comando shell

alt0() { o=$(bash -c 'grep -Pi -- '"'"'^\h*password\h+(requisite|required|sufficient)\h+pam_unix\.so(\h+[^#\n\r]+)? \h+(sha512|yescrypt)\b'"'"' /etc/pam.d/system-auth /etc/pam.d/password-auth' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'A line should be returned for both files, each including either sha512 or yescrypt.' || { echo step1: missing 'A line should be returned for both files, each including eit'; return 1; }; }; if alt0; then echo compliant; fi

Saída esperada

compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

The pam_unix arguments are configured through the active authselect profile so that the change is durable; editing /etc/pam.d/system-auth or /etc/pam.d/password-auth directly is not durable, because authselect regenerates those files (see the section overview for the authselect profile model). Set yescrypt, the default and recommended algorithm on this platform: 1. Ensure the system is using a custom authselect profile. If it is still on a stock profile, create and select one first, as described in the section overview. 2. On the pam_unix.so line in the password stack of the active custom profile templates (/etc/authselect/custom/<profile>/system-auth and /etc/authselect/custom/<profile>/pas…

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

tmaegis scan --target linux