Check: GEN000590
AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE:
GEN000590
(in versions v1 r14 through v1 r10)
Title
The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes. (Cat II impact)
Discussion
Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors. The use of unapproved algorithms may result in weak password hashes that are more vulnerable to compromise.
Check Content
Determine if the system creates password hashes using a FIPS 140-2 approved cryptographic hashing algorithm by verifying the value of pwd_algorithm in /etc/security/login.cfg. # grep pwd_algorithm /etc/security/login.cfg If the system is not configured to generate password hashes using a FIPS 140-2 approved algorithm, such as SHA256 or a successor, this is a finding.
Fix Text
Configure the system to use a FIPS 140-2 approved cryptographic hash algorithm for creating password hashes. # chsec -f /etc/security/login.cfg -s usw -a pwd_algorithm=ssha256
Additional Identifiers
Rule ID: SV-38938r1_rule
Vulnerability ID: V-22303
Group Title: GEN000590
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000803 |
The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication. |
Controls
Number | Title |
---|---|
IA-7 |
Cryptographic Module Authentication |