Detections
Analytics

1.84 SOL-11.1-040130

Information

Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors.

GROUP ID: V-216098RULE ID: SV-216098r1016291

Cryptographic hashes provide quick password authentication while not actually storing the password.

Solution

The root role is required.

Configure the system to disallow the use of UNIX encryption and enable SHA256 as the default encryption hash.

pfedit /etc/security/policy.conf

Check that the following lines exist and are not commented out:

CRYPT_DEFAULT=6CRYPT_ALGORITHMS_ALLOW=5,6

See Also

https://workbench.cisecurity.org/benchmarks/23873

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CAT|II, CCI|CCI-000196, CCI|CCI-004062, Rule-ID|SV-216098r1016291_rule, STIG-ID|SOL-11.1-040130, Vuln-ID|V-216098

Plugin: Unix

Control ID: 7947c3ae912804ce0cf3cdb94f8c8a7ff49d14cff75de7612e984a27fe248851