documentation_complete: true

title: 'Set Password Hashing Algorithm in /etc/login.defs'

description: |-
    In <tt>/etc/login.defs</tt>, add or correct the following line to ensure
    the system will use SHA-512 as the hashing algorithm:
    <pre>ENCRYPT_METHOD SHA512</pre>

rationale: 'Using a stronger hashing algorithm makes password cracking attacks more difficult.'

severity: medium

identifiers:
    cce: 27228-6

references:
    disa: 803
    nist: IA-5(b),IA-5(c),IA-5(1)(c),IA-7
    pcidss: Req-8.2.1
    srg: SRG-OS-000120
    stigid: RHEL-06-000063

ocil_clause: 'it does not'

ocil: |-
    Inspect <tt>/etc/login.defs</tt> and ensure the following line appears:
    <pre>ENCRYPT_METHOD SHA512</pre>
