SV-226460r603265: The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm. | Solaris 10 SPARC STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm.

Description

Discussion Text

Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors. The use of unapproved algorithms may result in weak password hashes more vulnerable to compromise.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000196SV-40790V-22304

References

DPMS Target Solaris 10 SPARC DISA DPMS Target Solaris 10 SPARC 4060

Checks

DISA STIG (Manual Reference)

Determine if any password hashes stored on the system were not generated using a FIPS 140-2 approved cryptographic hashing algorithm.

Procedure:
# cut -d ':' -f2 /etc/passwd
# cut -d ':' -f2 /etc/shadow

If any password hashes are present not beginning with $5$ or $6$,  this is a finding.

Verify that FIPS 140-2 approved cryptographic hashing algorithms are available.
# egrep '^[56]' /etc/security/crypt.conf
If no lines are returned, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.solaris11:def:48
# The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# password file hashes are SHA-2
# password_object (password_test)
test_1() {
  (getent passwd '^[^+\-].*' | cut -d: -f2) | grep -Pq '(!!|\$[56]\$|[\*x]$|\*LK\*|NP|UP)'
}
# shadow file hashes are SHA-2
# shadow_object (shadow_test)
test_2() {
  (getent shadow '^[^+\-].*' | cut -d: -f2) | grep -Pq '(!!|\$[56]\$|[\*x]$|\*LK\*|NP|UP)'
}
# FIPS 140-2 approved hashes are available for use
# textfilecontent54_object (textfilecontent54_test)
test_3() {
  grep -Pq '^[56][ \t]' '/etc/security/crypt.conf' &>/dev/null
}
# CRYPT_DEFAULT is set
# textfilecontent54_object (textfilecontent54_test)
test_4() {
  grep -Pq '^CRYPT_DEFAULT=[56]$' '/etc/security/policy.conf' &>/dev/null
}
# CRYPT_ALGORITHMS_ALLOW is set
# textfilecontent54_object (textfilecontent54_test)
test_5() {
  grep -Pq '^CRYPT_ALGORITHMS_ALLOW=5,6$' '/etc/security/policy.conf' &>/dev/null
}

if ! ( test_1 && test_2 && test_3 && test_4 && test_5 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.solaris11:def:48

if [ ! -f "/etc/security/crypt.conf" ]; then echo "PASS"; exit 0; fi
grep -q "^[56][ \\t]" /etc/security/crypt.conf || { echo "FAIL"; exit 1; }
if [ ! -f "/etc/security/policy.conf" ]; then echo "PASS"; exit 0; fi
grep -q "^CRYPT_DEFAULT=[56]$" /etc/security/policy.conf || { echo "FAIL"; exit 1; }
grep -q "^CRYPT_ALGORITHMS_ALLOW=5,6$" /etc/security/policy.conf || { echo "FAIL"; exit 1; }
for user in $(getent passwd | cut -d: -f1); do
    hash=$(echo "$user" | sed -e's/.*:[^:]*\:[^:]*\:[^:]*\:[^:]*\:[^:]*\://' -n -e 'p' /etc/shadow)
    [ -z "$hash" ] && continue
    case "$hash" in
        "!!|\\$[56]\\$|[\\*x]$|\\*LK\\*|NP|UP") :
        ;;
        *) echo "FAIL"; exit 1;;
    esac
done
echo "PASS"; exit 0

Remediation

If the /etc/security/crypt.conf file does not support FIPS 140-2 approved cryptographic hashing algorithms, upgrade to at least the Solaris 10 8/07 release.

Edit the /etc/security/policy.conf file.
# vi /etc/security/policy.conf
Uncomment or add the CRYPT_ALGORITHMS_ALLOW line and set it to "5,6". Update the CRYPT_DEFAULT default line to be equal to 5 or 6. The following lines are acceptable.

CRYPT_ALGORITHMS_ALLOW=5,6
CRYPT_DEFAULT=6

Update passwords for all accounts with non-compliant password hashes.