STIGQter: STIG Summary: Solaris 11 SPARC Security Technical Implementation Guide Version: 3 Release: 6 Benchmark Date: 01 Jul 2026:

Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors.

DISA Rule

SV-216333r1016276_rule

Vulnerability Number

V-216333

Group Title

SRG-OS-000073

Rule Version

SOL-11.1-040130

Severity

CAT II

CCI(s)

• CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.

Weight

10

Fix Recommendation

The root role is required.

Configure the system to disallow the use of UNIX encryption and enable SHA256 as the default encryption hash.

# pfedit /etc/security/policy.conf

Check that the following lines exist and are not commented out:
CRYPT_DEFAULT=6
CRYPT_ALGORITHMS_ALLOW=5,6

Check Contents

Determine which cryptographic algorithms are configured.

# grep ^CRYPT /etc/security/policy.conf

If the command output does not include the lines, this is a finding.

CRYPT_DEFAULT=6
CRYPT_ALGORITHMS_ALLOW=5,6

Vulnerability Number

V-216333

Documentable

False

Rule Version

SOL-11.1-040130

Severity Override Guidance

Determine which cryptographic algorithms are configured.

# grep ^CRYPT /etc/security/policy.conf

If the command output does not include the lines, this is a finding.

CRYPT_DEFAULT=6
CRYPT_ALGORITHMS_ALLOW=5,6

Check Content Reference

M

Target Key

4022