Ensure a strong password hashing algorithm is configured

Kako se proverava

Metod provere: Komanda ljuske

command -v grep >/dev/null 2>&1 || exit 1; [ -r /etc/security/passwd ] || exit 1; out=$( { grep -E "^[[:blank:]]*password[[:blank:]]*=[[:blank:]]*[^{*[:blank:]]{13}[[:blank:]]*$" /etc/security/passwd ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Execute the following command to enable an administrative requirement to update password on next login - when current password is still hashed using the crypt algorithm. #!/usr/bin/ksh -e # hash_chk:5.2.12 # Provided to CIS by AIXTools # Copyright AIXTools, 2022 #SystemAccounts are skipped, root is treated a regular account #pconsole is no longer a system account - being deprecated/removed SACTS1="(adm|bin|daemon|invscout|ipsec|lp|lpd|nobody|nuucp|sshd|sys|uucp)" SACTS2="(esa|srvproxy|imnadm|anonymou|ftp)" grep 'password[[:blank:]]= .............$' /etc/security/passwd | \ while read pass equals cryptedhash; do user=$(/usr/bin/grep -p $cryptedhash /etc/security/passwd |\ /usr/bin/egrep -vp "${SACTS1}:$" |\ /usr/bin/egrep -vp "${SACTS2}:$" |\ /usr/bin/egrep '[a-zA-z0-9]+:$' | sed -e s/:$//) print ${user}: needs to update passwd set -x /usr/bin/pwdadm -c ${user} /usr/bin/pwdadm -f ADMCHG ${user} set +x done

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target aix