Check: RHEL-08-010130
Red Hat Enterprise Linux 8 STIG:
RHEL-08-010130
(in versions v1 r4 through v1 r3)
Title
The RHEL 8 password-auth file must be configured to use a sufficient number of hashing rounds. (Cat II impact)
Discussion
The system must use a strong hashing algorithm to store the password. The system must use a sufficient number of hashing rounds to ensure the required level of entropy. Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.
Check Content
Check that a minimum number of hash rounds is configured by running the following command: $ sudo grep rounds /etc/pam.d/password-auth password sufficient pam_unix.so sha512 rounds=5000 If "rounds" has a value below "5000", or is commented out, this is a finding.
Fix Text
Configure RHEL 8 to encrypt all stored passwords with a strong cryptographic hash. Edit/modify the following line in the "/etc/pam.d/password-auth" file and set "rounds" to a value no lower than "5000": password sufficient pam_unix.so sha512 rounds=5000
Additional Identifiers
Rule ID: SV-230233r743919_rule
Vulnerability ID: V-230233
Group Title: SRG-OS-000073-GPOS-00041
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000196 |
The information system, for password-based authentication, stores only cryptographically-protected passwords. |
Controls
Number | Title |
---|---|
IA-5 (1) |
Password-Based Authentication |