The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
#!/bin/bash
# Reconstructed from oval:mil.disa.fso.rhel11:def:57
# The system must enforce compliance of the entire password during authentification.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
# - textfilecontent54_object (textfilecontent54_test) -- Make sure sha256 or sha512 is set in the appropriate file in /etc/pam.d/: cannot derive an existence probe for this object type
# test /etc/passwd file passwords
# textfilecontent54_object (textfilecontent54_test)
test_1() {
(sed -En 's/^[^:]+:([^:]+)/\1/p' '/etc/passwd') | grep -Pq '^\$|^_|^x$|^\*$|^!'
}
# test /etc/shadow file passwords
# textfilecontent54_object (textfilecontent54_test)
test_2() {
(sed -En 's/^[^:]+:([^:]+)/\1/p' '/etc/shadow') | grep -Pq '^\$|^_|^x$|^\*$|^!'
}
# Make sure /etc/libuser.conf is set to use hashing algorithm as crypt_style
# textfilecontent54_object (textfilecontent54_test)
test_4() {
grep -Pq '(^|\n)[ \t]*crypt_style = [Ss][Hh][Aa](256|512)[ \t]*(\n|$)' '/etc/libuser.conf' &>/dev/null
}
# Make sure /etc/login.defs is set to use ENCRYPT_METHOD with correct algorithm
# textfilecontent54_object (textfilecontent54_test)
test_5() {
grep -Pq '^\s*ENCRYPT_METHOD\s+[Ss][Hh][Aa](256|512)\s*$' '/etc/login.defs' &>/dev/null
}
if ! ( test_1 && test_2 && test_4 && test_5 ); then
echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
echo "FAIL (or see MANUAL REVIEW note above)"
fi Assessment Script Powered by AISandbox-executed
A standalone Shell script to assess this control automatically. Review before running it in your environment.
Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.
#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.rhel11:def:57
if [ ! -f "/etc/passwd" ] || [ ! -f "/etc/shadow" ] || [ ! -f "/etc/pam.d/system-auth" ] || [ ! -f "/etc/login.defs" ]; then echo "PASS"; exit 0; fi
if grep -qE '^\$|^_|^x$|^\\*$|^!' /etc/passwd /etc/shadow; then echo "FAIL"; exit 1; fi
if ! grep -qE '^\\s*password\\s+(?:sufficient|required)\\s+pam_unix\\.so\\s+.*(sha512|sha256).*$' /etc/pam.d/{system-auth,system-auth-ac,system-auth-local}; then echo "FAIL"; exit 1; fi
if ! grep -qE '^\\s*ENCRYPT_METHOD\\s+[Ss][Hh][Aa](256|512)\\s*$' /etc/login.defs; then echo "FAIL"; exit 1; fi
echo "PASS"; exit 0