Ensure password reuse is limited

高等級 2自動化cos

說明

The /etc/security/opasswd file stores the users' old passwords and can be checked to ensure that users are not recycling recent passwords. Forcing users not to reuse their past 5 passwords make it less likely that an attacker will be able to guess the password. Note that these change only apply to accounts configured on the local system.

檢查方式

稽核方法: Shell 指令

shell

bad=0; for p in /etc/pam.d/system-password /etc/pam.d/system-auth; do grep -Pq "^\h*password\h+[^#\n\r]+\h+pam_pwhistory\.so\h+([^#\n\r]+\h+)?remember=([5-9]|[1-9][0-9]+)\b" $p 2>/dev/null || bad=1; done; [ $bad -eq 0 ] && echo compliant || echo noncompliant

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Set remembered password history to conform to site policy. Many distributions provide tools for updating PAM configuration, consult your documentation for details. If no tooling is provided edit the appropriate /etc/pam.d/ configuration file and add or modify the pam_pwhistory.so or pam_unix.so lines to include the remember option: password required pam_pwhistory.so remember=5 password required pam_unix.so remember=5

屬性

作業系統: 不限
標籤: authcontainer-optimized-oscos
參考資料: CIS Google Container-Optimized OS Benchmark v1.2.0 - 5.2.2 Ensure password reuse is limited

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target cos --level 2