The system must enforce the correctness of the entire password during authentication.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-22302 | GEN000585 | SV-38276r1_rule | IAIA-1 IAIA-2 | Medium |
| Description |
|---|
| Some common password hashing schemes only process the first eight characters of a user's password, which reduces the effective strength of the password. |
| STIG | Date |
|---|---|
| HP-UX 11.31 Security Technical Implementation Guide | 2013-03-28 |
Details
| Check Text ( C-36264r2_chk ) |
|---|
| Verify that password hashes in /tcb/files/auth/[a-z,A-Z]*/* do not begin with a character other than a dollar sign ($). # find /tcb/files/auth/[a-z,A-Z]*/* | xargs -n1 egrep "name=|pwd=" If any password hash is present without an initial dollar sign ($) character, this is a finding. |
| Fix Text (F-31521r1_fix) |
|---|
| Change the passwords for all accounts using non-compliant password hashes. (This requires that GEN000590 is already met.) |