Title

The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm. (Cat II impact)

Discussion

Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors. The use of unapproved algorithms may result in weak password hashes more vulnerable to compromise.

Check Content

Determine if any password hashes stored on the system were not generated using a FIPS 140-2 approved cryptographic hashing algorithm. Procedure: # cut -d ':' -f2 /etc/passwd # cut -d ':' -f2 /etc/shadow If any password hashes are present not beginning with $5$ or $6$, this is a finding. Verify that FIPS 140-2 approved cryptographic hashing algorithms are available. # egrep '^[56]' /etc/security/crypt.conf If no lines are returned, this is a finding.

Fix Text

If the /etc/security/crypt.conf file does not support FIPS 140-2 approved cryptographic hashing algorithms, upgrade to at least the Solaris 10 8/07 release. Edit the /etc/security/policy.conf file. # vi /etc/security/policy.conf Uncomment or add the CRYPT_ALGORITHMS_ALLOW line and set it to "5,6". Update the CRYPT_DEFAULT default line to be equal to 5 or 6. The following lines are acceptable. CRYPT_ALGORITHMS_ALLOW=5,6 CRYPT_DEFAULT=6 Update passwords for all accounts with non-compliant password hashes.

Additional Identifiers

Rule ID: SV-227586r603266_rule

Vulnerability ID: V-227586

Group Title: SRG-OS-000073

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.