用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ubuntu2004-v300-5-3-3-4-3命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-ubuntu2004-v300-5-3-3-4-3 |
| description | Ensure pam_unix includes a strong password hashing algorithm |
| category | cis-iam |
| version | 3.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-20.04","pam","authentication"] |
| cis_id | 5.3.3.4.3 |
| cis_benchmark | CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
A cryptographic hash function converts an arbitrary-length input into a fixed length output. Password hashing performs a one-way transformation of a password, turning the password into another string, called the hashed password.
The pam_unix module can be configured to use one of the following hashing algorithms for user's passwords:
md5 - When a user changes their password next, encrypt it with the MD5 algorithm.bigcrypt - When a user changes their password next, encrypt it with the DEC C2 algorithm.sha256 - When a user changes their password next, encrypt it with the SHA256 algorithm. The SHA256 algorithm must be supported by the crypt(3) function.sha512 - When a user changes their password next, encrypt it with the SHA512 algorithm. The SHA512 algorithm must be supported by the crypt(3) function.blowfish - When a user changes their password next, encrypt it with the blowfish algorithm. The blowfish algorithm must be supported by the crypt(3) function.The SHA-512 algorithm provides a stronger hash than other algorithms used for password hash generation. A stronger hash provides additional protection to the system by increasing the level of effort needed for an attacker to successfully determine local user passwords.
Note: These changes only apply to the local system.
Run the following command to verify that a strong password hashing algorithm is set on the pam_unix.so module:
# grep -PH -- '^\h*password\h+([^#\n\r]+)\h+pam_unix\.so\h+([^#\n\r]+\h+)?{sha512}\b' /etc/pam.d/common-password
Output should be similar to:
/etc/pam.d/common-password:password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt
Verify that the line(s) includes sha512.
Note: yescrypt will be acceptable - IF - it becomes supported.
Run the following command:
# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_unix\.so/) print FILENAME}' /usr/share/pam-configs/*
Edit any returned files and edit or add a the strong sha512 hashing algorithm to the pam_unix lines in the Password section.
Example File:
Name: Unix authentication
Default: yes
Priority: 256
Auth-Type: Primary # <- Start of "Auth" section
Auth:
[success=end default=ignore] pam_unix.so try_first_pass
Auth-Initial:
[success=end default=ignore] pam_unix.so
Account-Type: Primary # <- Start of "Account" section
Account:
[success=end new_authtok_reqd=done default=ignore] pam_unix.so
Account-Initial:
[success=end new_authtok_reqd=done default=ignore] pam_unix.so
Session-Type: Additional # <- Start of "Session" section
Session:
required pam_unix.so
Session-Initial:
required pam_unix.so
Password-Type: Primary # <- Start of "Password" section
Password:
[success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512 # <- **ensure hashing algorithm is sha512**
Password-Initial:
[success=end default=ignore] pam_unix.so obscure sha512 # <- **ensure hashing algorithm is sha512**
Note: yescrypt will be acceptable - IF - it becomes supported.
Run the following command to update the files in the /etc/pam.d/ directory:
# pam-auth-update --enable <MODIFIED_PROFILE_NAME>
Example:
# pam-auth-update --enable unix
The following command may be used to expire all non-system user ID's immediately and force them to change their passwords on next login. Any system accounts that need to be expired should be carefully done separately by the system administrator to prevent any potential problems.
# awk -F: '{ $3<'"$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)"' && $1 != "nfsnobody" ) { print $1 }' /etc/passwd | xargs -n 1 chage -d 0
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.11 Encrypt Sensitive Data at Rest | * | * | |
| v7 | 16.4 Encrypt or Hash all Authentication Credentials | * | * |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1003, T1003.008, T1110, T1110.002 | TA0006 | M1041 |