UCF STIG Viewer Logo

The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes.


Overview

Finding ID Version Rule ID IA Controls Severity
V-227585 GEN000590 SV-227585r603266_rule Medium
Description
Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors. The use of unapproved algorithms may result in weak password hashes more vulnerable to compromise.
STIG Date
Solaris 10 X86 Security Technical Implementation Guide 2020-12-04

Details

Check Text ( C-36445r602938_chk )
Verify the traditional UNIX crypt algorithm is deprecated.
# egrep CRYPT_ALGORITHMS_ALLOW /etc/security/policy.conf
If CRYPT_ALGORITHMS_ALLOW is not set, is not set to "6", or is not set to "5,6", this is a finding.

Verify new password hashes are generated using either the SHA-256 or SHA-512 cryptographic hashing algorithm.
# egrep CRYPT_DEFAULT /etc/security/policy.conf
If CRYPT_DEFAULT is not set or is not equal to 5 or 6, this is a finding.
Fix Text (F-36409r602939_fix)
Edit the /etc/security/policy.conf file.
# vi /etc/security/policy.conf
Uncomment or add the CRYPT_ALGORITHMS_ALLOW line and set it to "5,6". Update the CRYPT_DEFAULT default line to be equal to 5 or 6. The following lines are acceptable.

CRYPT_ALGORITHMS_ALLOW=5,6
CRYPT_DEFAULT=6