Detections
Analytics

GEN000585 - The system must enforce the entire password during authentication - 'Verify no password hashes in /etc/passwd'

Information

Some common password hashing schemes only process the first eight characters of a user's password, which reduces the effective strength of the password.

Solution

Configure the system to enforce the correctness of the entire password during authentication.
Configure the system to use sha password hashing.
#chsec -f /etc/security/login.cfg -s usw -a pwd_algorithm=ssha256

See Also

http://iasecontent.disa.mil/stigs/zip/U_STIG_Library_2015_07.zip

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, CAT|II, CCI|CCI-000205, Rule-ID|SV-38769r1_rule, STIG-ID|GEN000585, Vuln-ID|V-22302

Plugin: Unix

Control ID: 94867f512c2912ec893104f00da458dd5f3e47f06ab2f51898a847b1dcbac047