Ensure passwords are controlled by password attributes

高级别 1自动化aix

说明

Ensure passwords are required to pass password attribute controls. If password restrictions are not enforced for some accounts, those accounts represent a much greater risk of being compromised by an attacker as they may have weaker passwords vulnerable to brute force attack or provide an indefinite window of opportunity ... Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

检查方式

审计方法: Shell 命令

shell

command -v grep >/dev/null 2>&1 || exit 1; [ -r /etc/security/passwd ] || exit 1; out=$( { grep NOCHECK /etc/security/passwd ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

In the file /etc/security/passwd clear the NOCHECK attribute from all users: #!/usr/bin/ksh -e # Copyright AIXTools, 2022 /usr/bin/grep -p NOCHECK /etc/security/passwd | /usr/bin/egrep ":$" | sed -e 's/://' | while read USER; do /usr/bin/pwdadm -c $USER /usr/bin/pwdadm -f ADMCHG $USER done

属性

操作系统: 任意
标签: aixpassword-policy
参考: CIS IBM AIX 7 Benchmark v1.2.0 - 5.2.4 Ensure passwords are controlled by password attributes

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target aix