documentation_complete: true

prodtype: rhel7,fedora

title: 'Set PAM''s Password Hashing Algorithm'

description: "The PAM system service can be configured to only store encrypted representations of passwords.\nIn <tt>/etc/pam.d/system-auth</tt>, the <tt>password</tt> section of the file controls \nwhich PAM modules execute during a password change. Set the <tt>pam_unix.so</tt> \nmodule in the <tt>password</tt> section to include the argument <tt>sha512</tt>, as shown below:\n<br />\n<pre>password    sufficient    pam_unix.so sha512 <i>other arguments...</i></pre>\n<br />\nThis will help ensure when local users change their passwords, hashes for the new\npasswords will be generated using the SHA-512 algorithm. This is the default."

rationale: "Passwords need to be protected at all times, and encryption is the standard method for protecting\npasswords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily\ncompromised. Passwords that are encrypted with a weak algorithm are no more protected than if they \nare kepy in plain text.\n<br /><br />\nThis setting ensures user and group account administration utilities are configured to store only\nencrypted representations of passwords. Additionally, the <tt>crypt_style</tt> configuration option\nensures the use of a strong hashing algorithm that makes password cracking attacks more difficult."

severity: medium

identifiers:
    cce@rhel7: 27104-9

references:
    cis: 6.3.1
    cjis: 5.6.2.2
    cui: 3.13.11
    disa: 196
    nist: IA-5(b),IA-5(c),IA-5(1)(c),IA-7
    pcidss: Req-8.2.1
    srg: SRG-OS-000073-GPOS-00041
    stigid@rhel7: "010200"

ocil_clause: 'it does not'

ocil: |-
    Inspect the <tt>password</tt> section of <tt>/etc/pam.d/system-auth</tt> and
    ensure that the <tt>pam_unix.so</tt> module includes the argument
    <tt>sha512</tt>:
    <pre>$ grep sha512 /etc/pam.d/system-auth</pre>
