STIGQter: STIG Summary: Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Ubuntu 22.04 LTS must encrypt all stored passwords with a FIPS 140-3-approved cryptographic hashing algorithm.

DISA Rule

SV-260572r971535_rule

Vulnerability Number

V-260572

Group Title

SRG-OS-000120-GPOS-00061

Rule Version

UBTU-22-611070

Severity

CAT II

CCI(s)

• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Configure Ubuntu 22.04 LTS to encrypt all stored passwords.

Add or modify the following line in the "/etc/login.defs" file:

ENCRYPT_METHOD SHA512

Check Contents

Verify that the shadow password suite configuration is set to encrypt passwords with a FIPS 140-3 approved cryptographic hashing algorithm by using the following command:

$ grep -i '^\s*encrypt_method' /etc/login.defs
ENCRYPT_METHOD SHA512

If "ENCRYPT_METHOD" does not equal SHA512 or greater, is commented out, or is missing, this is a finding.

Vulnerability Number

V-260572

Documentable

False

Rule Version

UBTU-22-611070

Severity Override Guidance

Verify that the shadow password suite configuration is set to encrypt passwords with a FIPS 140-3 approved cryptographic hashing algorithm by using the following command:

$ grep -i '^\s*encrypt_method' /etc/login.defs
ENCRYPT_METHOD SHA512

If "ENCRYPT_METHOD" does not equal SHA512 or greater, is commented out, or is missing, this is a finding.

Check Content Reference

M

Target Key

5594