elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-22 13:37:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

99.5.4.5.2: fix bug where sha512 option rounds provoke KO (#112)

Browse Source
This commit is contained in:
Thibault Ayanides 2021-08-10 10:30:35 +02:00 committed by GitHub
parent 01c3d1b98c
commit afed5a9dce
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
bin/hardening/99.5.4.5.1_acc_logindefs_sha512.sh
View File

@ -49,7 +49,6 @@ apply() {
info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing" info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing"
replace_in_file "$CONF_FILE" "^$(echo "$CONF_LINE" | cut -d ' ' -f1)[[:space:]]*.*" "$CONF_LINE" replace_in_file "$CONF_FILE" "^$(echo "$CONF_LINE" | cut -d ' ' -f1)[[:space:]]*.*" "$CONF_LINE"
fi fi
/etc/init.d/ssh reload >/dev/null 2>&1
fi fi
} }

2
bin/hardening/99.5.4.5.2_acc_shadow_sha512.sh
View File

@ -37,7 +37,7 @@ audit() {
pw_found+="$user " pw_found+="$user "
ok "User $user has a disabled password." ok "User $user has a disabled password."
# Check password against $6$<salt>$<encrypted>, see `man 3 crypt` # Check password against $6$<salt>$<encrypted>, see `man 3 crypt`
elif [[ $passwd =~ ^\$6\$[a-zA-Z0-9./]{2,16}\$[a-zA-Z0-9./]{86}$ ]]; then elif [[ $passwd =~ ^\$6(\$rounds=[0-9]+)?\$[a-zA-Z0-9./]{2,16}\$[a-zA-Z0-9./]{86}$ ]]; then
pw_found+="$user " pw_found+="$user "
ok "User $user has suitable SHA512 hashed password." ok "User $user has suitable SHA512 hashed password."
else else

8
tests/hardening/99.5.4.5.2_acc_shadow_sha512.sh
View File

@ -29,4 +29,12 @@ EOF
register_test retvalshouldbe 0 register_test retvalshouldbe 0
register_test contain "User secaudit has suitable SHA512 hashed password" register_test contain "User secaudit has suitable SHA512 hashed password"
run sha512pass /opt/debian-cis/bin/hardening/"${script}".sh --audit-all run sha512pass /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
chpasswd -c SHA512 -s 1000 <<EOF
secaudit:mypassword
EOF
describe Pass: Found properly hashed password with custom round number
register_test retvalshouldbe 0
register_test contain "User secaudit has suitable SHA512 hashed password"
run sha512pass /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
} }