documentation_complete: true

prodtype: rhel7,fedora

title: 'Set Password Hashing Algorithm in /etc/login.defs'

description: |-
    In <tt>/etc/login.defs</tt>, add or correct the following line to ensure
    the system will use SHA-512 as the hashing algorithm:
    <pre>ENCRYPT_METHOD SHA512</pre>

rationale: |-
    Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.
    If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords
    that are encrypted with a weak algorithm are no more protected than if they are kept in plain text.
    <br /><br />
    Using a stronger hashing algorithm makes password cracking attacks more difficult.

severity: medium

identifiers:
    cce@rhel7: 27124-7

references:
    cis: 6.3.1
    cjis: 5.6.2.2
    cui: 3.13.11
    disa: 196
    nist: IA-5(b),IA-5(c),IA-5(1)(c),IA-7
    pcidss: Req-8.2.1
    srg: SRG-OS-000073-GPOS-00041
    stigid@rhel7: "010210"

ocil_clause: 'it does not'

ocil: |-
    Inspect <tt>/etc/login.defs</tt> and ensure the following line appears:
    <pre>ENCRYPT_METHOD SHA512</pre>
