Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-22304 | GEN000595 | SV-26316r2_rule | DCNR-1 IAIA-1 IAIA-2 | Medium |
Description |
---|
Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors. The use of unapproved algorithms may result in weak password hashes more vulnerable to compromise. |
STIG | Date |
---|---|
Red Hat Enterprise Linux 5 Security Technical Implementation Guide | 2016-06-01 |
Check Text ( C-35965r2_chk ) |
---|
Check all password hashes in /etc/passwd or /etc/shadow begin with '$5$' or '$6$'. Procedure: # cut -d ':' -f2 /etc/passwd # cut -d ':' -f2 /etc/shadow Any password hashes present not beginning with '$5$' or, '$6$' is a finding. Any entries showing only NP, LK, or x are not findings. |
Fix Text (F-31221r1_fix) |
---|
Change the passwords for all accounts using non-compliant password hashes. (This requires GEN000590 is already met.) |