documentation_complete: true

title: 'Set Password Hashing Algorithm in /etc/pam.d/system-auth'

description: |-
    In <tt>/etc/pam.d/system-auth</tt>, the <tt>password</tt> section of
    the file controls which PAM modules execute during a password change.
    Set the <tt>pam_unix.so</tt> module in the
    <tt>password</tt> section to include the argument <tt>sha512</tt>, as shown below:
    <pre>password    sufficient    pam_unix.so sha512 <i>other arguments...</i></pre>
    This will help ensure when local users change their passwords, hashes for the new
    passwords will be generated using the SHA-512 algorithm.
    This is the default.

rationale: 'Using a stronger hashing algorithm makes password cracking attacks more difficult.'

severity: medium

identifiers:
    cce: 26303-8

references:
    disa: 803
    nist: IA-5(b),IA-5(c),IA-5(1)(c),IA-7
    pcidss: Req-8.2.1
    srg: SRG-OS-000120
    stigid: RHEL-06-000062

ocil_clause: 'it does not'

ocil: |-
    Inspect the <tt>password</tt> section of <tt>/etc/pam.d/system-auth</tt>  and
    ensure that the <tt>pam_unix.so</tt> module includes the argument
    <tt>sha512</tt>:
    <pre>$ grep sha512 /etc/pam.d/system-auth</pre>
