TMA-GITLAB-2.1.9
Ensure default passwords are not used
Описание
Do not use default passwords of build tools and components. Sometimes build tools and components are provided with default passwords for the first login. This password is intended to be used only on the first login and should be changed immediately after. Using the default password substantially increases the attack risk. It is especially important to ensure that default passwords are not used in build tools and components.
Как проверяется
Метод проверки: Ручная проверка
Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.
GitLab’s default root password depends on the installation method, and when the installation occurred: 1. When deploying a GitLab instance using the official AWS AMI, the root password to the instance is the EC2 Instance ID 2. Most installation methods allow a non-default password to be provided as configuration 3. Prior to 14.0 the default password was 5iveL!fe 4. Otherwise the default password is unique and randomly generated. Attempt to log in as root using a suspected default password to audit whether it has changed. For any other external build tools, ensure the password used is not the default one.
Как исправляется
Метод исправления: Рекомендация или патч инфраструктуры
GitLab’s root password can be changed by an administrator using the UI, the “gitlab:password:reset” rake task, or by using the Rails console. For each build tool with a default password, change to a unique cryptographically secure pseudorandom password.
Свойства
- Операционные системы
- Любая
- Теги
- authdevsecopsgitlab
- Источник
- CIS GitLab Benchmark v1.0.1 - 2.1.9 Ensure default passwords are not used