SV-26313r2: The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes. | Red Hat Enterprise Linux 5 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes.

Description

Discussion Text

Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors. The use of unapproved algorithms may result in weak password hashes more vulnerable to compromise.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000803CCE-14063-2

Additional Details

Responsibility

System Administrator

References

DPMS Target Red Hat 5 DISA DPMS Target Red Hat 5 2154

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.rhel11:def:58
# The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - textfilecontent54_object (textfilecontent54_test) -- Make sure sha256 or sha512 is set in the appropriate file in /etc/pam.d/: cannot derive an existence probe for this object type

# Make sure /etc/libuser.conf is set to use hashing algorithm as crypt_style
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  grep -Pq '(^|\n)[ \t]*crypt_style = [Ss][Hh][Aa](256|512)[ \t]*(\n|$)' '/etc/libuser.conf' &>/dev/null
}
# Make sure /etc/login.defs is set to use ENCRYPT_METHOD with correct algorithm
# textfilecontent54_object (textfilecontent54_test)
test_3() {
  grep -Pq '^\s*ENCRYPT_METHOD\s+[Ss][Hh][Aa](256|512)\s*$' '/etc/login.defs' &>/dev/null
}

if ( test_2 && test_3 ); then
  echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
  echo "FAIL (or see MANUAL REVIEW note above)"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.rhel11:def:58
if [ ! -f "/etc/pam.d/system-auth" ] && [ ! -f "/etc/pam.d/system-auth-ac" ] && [ ! -f "/etc/pam.d/system-auth-local" ]; then echo "PASS"; exit 0; fi
if [ ! -f "/etc/libuser.conf" ]; then echo "PASS"; exit 0; fi
if ! grep -q "^\\s*crypt_style\\s*=\\s*SHA[256512]\\s*$" /etc/libuser.conf; then echo "FAIL"; exit 1; fi
if [ ! -f "/etc/login.defs" ]; then echo "PASS"; exit 0; fi
if ! grep -q "^\\s*ENCRYPT_METHOD\\s*=\\s*SHA[256512]\\s*$" /etc/login.defs; then echo "FAIL"; exit 1; fi
echo "PASS"; exit 0

Remediation

Change the default password algorithm.
# authconfig --passalgo=sha512 --update

NOTE: Executing the above command will also update the required parameters in /etc/login.defs and /etc/libuser.conf