Red Hat Enterprise Linux 5 Security Technical Implementation Guide

The Red Hat Enterprise Linux 5 Security Technical Implementation Guide (V1 R18) has 571 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

571STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R18

CurrentPublished Fri Apr 28 2017

The system must enforce compliance of the entire password during authentification.

Red Hat Enterprise Linux 5 Security Technical Implementation Guide

Assessment Title

Rule Text

The system must enforce compliance of the entire password during authentification.

Description

Discussion Text

Some common password hashing schemes only process the first eight characters of a user's password, which reduces the effective strength of the password.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-22302

Rule

SV-37261r2_rule

Severity

medium

Rule Version

GEN000585

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify no valid password hash in /etc/passwd or /etc/shadow begins with a character other than an underscore (_) or dollar sign ($).

# cut -d ':' -f2 /etc/passwd
# cut -d ':' -f2 /etc/shadow

If any valid password hash is present that does not have an initial underscore (_) or dollar sign ($) character, this is a finding.

Note: Locked accounts are indicated by a leading exclamation point (!). System accounts, other than "root", may have an asterisk (*) in the password field. On systems utilizing shadow passwords, the password field in /etc/passwd will be a single "x".

Implementation Procedure

Fix Text

Change the passwords for all accounts using non-compliant password hashes. 

(This requires GEN000590 is already met.)

STIG check 88 of 571 in the Red Hat Enterprise Linux 5 STIG checklist

← Previous · V-22301The system must display a publicly-viewable pattern during a graphical desktop environment session lock.Next · V-22303 →The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes.