search

simp / inspec-profile-disa_stig-el7

InSpec Profile for the EL7 DISA STIG
Apache License 2.0
22 stars 46 forks source link

V-71947 Does not Consider Authentication Other Than Passwords #58

Open Bialogs opened 5 years ago

Bialogs commented 5 years ago

The check text for V-71947 states that "If passwords are not being used for authentication, this is Not Applicable." This check does not perform a check to see if passwords are being used for authentication.

This test could either check the system to confirm that password authentication is enabled and continue, or create a new attribute similar to smart_card_status which will reduce the impact if disabled.

trevor-vaughan commented 5 years ago

Honestly, I have no idea how to do this effectively across all of the PAM subsystems considering all the ways that passwords can be hooked in and how easy it is to simply jump parts of the stack.

I guess that you could try logging in as the user and see if there is a password prompt but that's still not really authoritative for all potential methods.