TMA-COS-5.2.2
Ensure password reuse is limited
Opis
The /etc/security/opasswd file stores the users' old passwords and can be checked to ensure that users are not recycling recent passwords. Forcing users not to reuse their past 5 passwords make it less likely that an attacker will be able to guess the password. Note that these change only apply to accounts configured on the local system.
Kako se proverava
Metod provere: Komanda ljuske
bad=0; for p in /etc/pam.d/system-password /etc/pam.d/system-auth; do grep -Pq "^\h*password\h+[^#\n\r]+\h+pam_pwhistory\.so\h+([^#\n\r]+\h+)?remember=([5-9]|[1-9][0-9]+)\b" $p 2>/dev/null || bad=1; done; [ $bad -eq 0 ] && echo compliant || echo noncompliant- Očekivani izlaz
compliant
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
Set remembered password history to conform to site policy. Many distributions provide tools for updating PAM configuration, consult your documentation for details. If no tooling is provided edit the appropriate /etc/pam.d/ configuration file and add or modify the pam_pwhistory.so or pam_unix.so lines to include the remember option: password required pam_pwhistory.so remember=5 password required pam_unix.so remember=5
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- authcontainer-optimized-oscos
- Referenca
- CIS Google Container-Optimized OS Benchmark v1.2.0 - 5.2.2 Ensure password reuse is limited
Proverite ovaj računar
Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.
tmaegis scan --target cos --level 2