STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

The TOSS pam_unix.so module must be configured in the password-auth file to use a FIPS 140-2-approved cryptographic hashing algorithm for system authentication.

DISA Rule

SV-252917r971535_rule

Vulnerability Number

V-252917

Group Title

SRG-OS-000120-GPOS-00061

Rule Version

TOSS-04-010060

Severity

CAT II

CCI(s)

• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Configure TOSS to use a FIPS 140-2-approved cryptographic hashing algorithm for system authentication.

Edit and/or modify the following line in the "/etc/pam.d/password-auth" file to include the sha512 option for pam_unix.so:

password sufficient pam_unix.so sha512

Check Contents

Verify that the pam_unix.so module is configured to use sha512.

Check that the pam_unix.so module is configured to use sha512 in /etc/pam.d/password-auth with the following command:

$ sudo grep password /etc/pam.d/password-auth | grep pam_unix

password sufficient pam_unix.so sha512

If "sha512" is missing, or is commented out, this is a finding.

Vulnerability Number

V-252917

Documentable

False

Rule Version

TOSS-04-010060

Severity Override Guidance

Verify that the pam_unix.so module is configured to use sha512.

Check that the pam_unix.so module is configured to use sha512 in /etc/pam.d/password-auth with the following command:

$ sudo grep password /etc/pam.d/password-auth | grep pam_unix

password sufficient pam_unix.so sha512

If "sha512" is missing, or is commented out, this is a finding.

Check Content Reference

M

Target Key

5469