Detections
Analytics

4.5.1.1 Ensure strong password hashing algorithm is configured

Information

A cryptographic hash function converts an arbitrary-length input into a fixed length output. Password hashing performs a one-way transformation of a password, turning the password into another string, called the hashed password.

The SHA-512 algorithms provide a stronger hash than other algorithms used by FreeBSD for password hash generation. A stronger hash provides additional protection to the system by increasing the level of effort needed for an attacker to successfully determine local user passwords.

Note: These changes only apply to the local system.

Solution

Set password hashing algorithm to sha512.

Edit /etc/login.conf and edit or add a line like the following for the default configuration:

:passwd_format=sha512:

After editing the file regenerate the login.conf.db with the command:

# cap_mkdb /etc/login.conf

Note: This only effects local users and passwords created after updating the files to use sha512 . If it is determined that the password algorithm being used is not sha512, once it is changed, it is recommended that all group passwords be updated to use the stronger hashing algorithm.

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-28, 800-53|SC-28(1), CSCv7|16.4

Plugin: Unix

Control ID: 52cb63dab8e3cff9013ba2bd34fc3f6a9725a37b5685f6b39dd5a77cc6d76f13