documentation_complete: true

prodtype: rhel7,fedora

title: 'Set Password Hashing Algorithm in /etc/libuser.conf'

description: |-
    In <tt>/etc/libuser.conf</tt>, add or correct the following line in its
    <tt>[defaults]</tt> section to ensure the system will use the SHA-512
    algorithm for password hashing:
    <pre>crypt_style = sha512</pre>

rationale: "Passwords need to be protected at all times, and encryption is the standard method for protecting\npasswords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily\ncompromised. Passwords that are encrypted with a weak algorithm are no more protected than if they \nare kepy in plain text.\n<br /><br />\nThis setting ensures user and group account administration utilities are configured to store only\nencrypted representations of passwords. Additionally, the <tt>crypt_style</tt> configuration option\nensures the use of a strong hashing algorithm that makes password cracking attacks more difficult."

severity: medium

identifiers:
    cce@rhel7: 27053-8

references:
    cjis: 5.6.2.2
    cui: 3.13.11
    disa: 196
    nist: IA-5(b),IA-5(c),IA-5(1)(c),IA-7
    pcidss: Req-8.2.1
    srg: SRG-OS-000073-GPOS-00041
    stigid@rhel7: "010220"

ocil_clause: 'it does not'

ocil: |-
    Inspect <tt>/etc/libuser.conf</tt> and ensure the following line appears
    in the <tt>[default]</tt> section:
    <pre>crypt_style = sha512</pre>
