Detections
Analytics

1.84 SOL-11.1-040130

Information

Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors.

GROUP ID: V-216333
RULE ID: SV-216333r1016276

Cryptographic hashes provide quick password authentication while not actually storing the password.

Solution

The root role is required.

Configure the system to disallow the use of UNIX encryption and enable SHA256 as the default encryption hash.

# pfedit /etc/security/policy.conf

Check that the following lines exist and are not commented out:

CRYPT_DEFAULT=6
CRYPT_ALGORITHMS_ALLOW=5,6

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CAT|II, CCI|CCI-000196, CCI|CCI-004062, Rule-ID|SV-216333r1016276_rule, STIG-ID|SOL-11.1-040130, Vuln-ID|V-216333

Plugin: Unix

Control ID: 3655c27fcd939a672843e95cf925a68256a6413eacabef482283084c77d938bb