Ensure password hashing algorithm is SHA-512

VisokaNivo 1Automatskaazure-container-linux

Opis

The commands below change password encryption from md5 to sha512 (a much stronger hashing algorithm). All existing accounts will need to perform a password change to upgrade the stored hashes to the new algorithm. Note: • These changes only apply to accounts configured on the local system. • Additional module options may be set, recommendation only covers those listed here. Audit: Passes when pam_unix.so on the password stack of /etc/pam.d/system-auth and /etc/pam.d/system-password uses the sha512 option.

Kako se proverava

Metod provere: Komanda ljuske

shell

bad=0; for p in /etc/pam.d/system-auth /etc/pam.d/system-password; do grep -Pq "^\h*password\h+([^#\n\r]+)?\h+pam_unix\.so\h+([^#\n\r]+\h+)?sha512\b" $p 2>/dev/null || bad=1; done; [ $bad -eq 0 ] && echo compliant || echo noncompliant

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Edit the /etc/pam.d/system-password and /etc/pam.d/system-auth files to include sha512 option and remove the md5 option for pam_unix.so: password sufficient pam_unix.so sha512 Note: • Any system accounts that need to be expired should be carefully done separately by the system administrator to prevent any potential problems. • If it is determined that the password algorithm being used is not SHA-512, once it is changed, it is recommended that all user ID's be immediately expired and forced to change their passwords on next login, In accordance with local site policies.

Svojstva

Operativni sistemi: Bilo koji
Oznake: azure-container-linuxpampasswords
Referenca: CIS Azure Container Linux Benchmark v1.0.0 - 5.4.3 Ensure password hashing algorithm is SHA-512

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target azure-container-linux