Detections
Analytics
AIX7-00-001128 - AIX must use Loadable Password Algorithm (LPA) password hashing algorithm.
Information
The default legacy password hashing algorithm, crypt(), uses only the first 8 characters from the password string, meaning the user's password is truncated to eight characters. If the password is shorter than 8 characters, it is padded with zero bits on the right.The crypt() is a modified DES algorithm that is vulnerable to brute force password guessing attacks and also to cracking the DES-hashing algorithm by using techniques such as pre-computation.
With the Loadable Password Algorithm (LPA) framework release, AIX implemented a set of LPAs using MD5, SHA2, and Blowfish algorithms. These IBM proprietary password algorithms support a password longer than 8 characters and Unicode characters in passwords.
Solution
From the command prompt, run the following command to set system wide password algorithm to 'ssha512' so that it supports passwords longer than 8-character:# chsec -f /etc/security/login.cfg -s usw -a pwd_algorithm=ssha512
For each users who have hashed passwords in '/etc/security/passwd' file that does not start with '{ssha512}', run passwd commands to reset the users' passwords so that they have to change their passwords in the next login:
# passwd [user_name]
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_IBM_AIX_7-x_V3R1_STIG.zip
Item Details
Audit Name: DISA STIG AIX 7.x v3r1
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1)(a), CAT|I, CCI|CCI-000205, CCI|CCI-004066, Rule-ID|SV-215225r1009541_rule, STIG-ID|AIX7-00-001128, STIG-Legacy|SV-101413, STIG-Legacy|V-91315, Vuln-ID|V-215225
Plugin: Unix
Control ID: 409c24132cda0cde9c00d590b90b21d22d7014398ed310a7fb90cbeb2b347259