Ensure pam_unix includes a strong password hashing algorithm

Kako se proverava

Metod provere: Komanda ljuske

alt0() { o=$(bash -c 'grep -Pi -- '"'"'^\h*password\h+(requisite|required|sufficient)\h+pam_unix\.so(\h+[^#\n\r]+)? \h+(sha512|yescrypt)\b'"'"' /etc/pam.d/system-auth /etc/pam.d/password-auth' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'A line should be returned for both files, each including either sha512 or yescrypt.' || { echo step1: missing 'A line should be returned for both files, each including eit'; return 1; }; }; if alt0; then echo compliant; fi

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

The pam_unix arguments are configured through the active authselect profile so that the change is durable; editing /etc/pam.d/system-auth or /etc/pam.d/password-auth directly is not durable, because authselect regenerates those files (see the section overview for the authselect profile model). Set yescrypt, the default and recommended algorithm on this platform: 1. Ensure the system is using a custom authselect profile. If it is still on a stock profile, create and select one first, as described in the section overview. 2. On the pam_unix.so line in the password stack of the active custom profile templates (/etc/authselect/custom/<profile>/system-auth and /etc/authselect/custom/<profile>/pas…

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target linux