Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The system must enforce compliance of the entire password during authentication.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-22302 | GEN000585 | SV-26318r1_rule | IAIA-1 IAIA-2 | Medium |
| Description |
|---|
| Some common password hashing schemes only process the first eight characters of a user's password, which reduces the effective strength of the password. |
| STIG | Date |
|---|---|
| Solaris 10 X86 Security Technical Implementation Guide | 2019-06-24 |
Details
| Check Text ( C-27433r2_chk ) |
|---|
| Verify no password hash in /etc/passwd or /etc/shadow begins with a character other than an underscore (_) or dollar sign ($). # cut -d ':' -f2 /etc/passwd | egrep -v '^[*!$_]' # cut -d ':' -f2 /etc/shadow | egrep -v '^[*!$_]' If any unlocked password hash is present without an initial underscore (_) or dollar sign ($) character, this is a finding. |
| Fix Text (F-23473r1_fix) |
|---|
| Edit /etc/security/policy.conf and add or change the CRYPT_DEFAULT setting to something other than __unix__, such as 6. Allowable values for CRYPT_DEFAULT may be found in the /etc/security/crypt.conf file. Change any passwords using non-compliant hashes. |