Ensure pam_unix includes a strong password hashing algorithm

检查方式

审计方法: Shell 命令

alt0() { o=$(bash -c 'grep -Pi -- '"'"'^\h*password\h+(requisite|required|sufficient)\h+pam_unix\.so(\h+[^#\n\r]+)? \h+(sha512|yescrypt)\b'"'"' /etc/pam.d/system-auth /etc/pam.d/password-auth' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'A line should be returned for both files, each including either sha512 or yescrypt.' || { echo step1: missing 'A line should be returned for both files, each including eit'; return 1; }; }; if alt0; then echo compliant; fi

预期输出

compliant

修复方式

修复方法: 操作指南或基础设施补丁

The pam_unix arguments are configured through the active authselect profile so that the change is durable; editing /etc/pam.d/system-auth or /etc/pam.d/password-auth directly is not durable, because authselect regenerates those files (see the section overview for the authselect profile model). Set yescrypt, the default and recommended algorithm on this platform: 1. Ensure the system is using a custom authselect profile. If it is still on a stock profile, create and select one first, as described in the section overview. 2. On the pam_unix.so line in the password stack of the active custom profile templates (/etc/authselect/custom/<profile>/system-auth and /etc/authselect/custom/<profile>/pas…

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

tmaegis scan --target linux