documentation_complete: true

title: 'Set Password Hashing Algorithm in /etc/libuser.conf'

description: |-
    In <tt>/etc/libuser.conf</tt>, add or correct the following line in its
    <tt>[defaults]</tt> section to ensure the system will use the SHA-512
    algorithm for password hashing:
    <pre>crypt_style = sha512</pre>

rationale: 'Using a stronger hashing algorithm makes password cracking attacks more difficult.'

severity: medium

identifiers:
    cce: 27229-4

references:
    disa: 803
    nist: IA-5(b),IA-5(c),IA-5(1)(c),IA-7
    pcidss: Req-8.2.1
    srg: SRG-OS-000120
    stigid: RHEL-06-000064

ocil_clause: 'it does not'

ocil: |-
    Inspect <tt>/etc/libuser.conf</tt> and ensure the following line appears
    in the <tt>[default]</tt> section:
    <pre>crypt_style = sha512</pre>
