SV-91795r2_rule
V-77099
SRG-OS-000073-GPOS-00041
SLES-12-010220
CAT II
10
Configure the SUSE operating system to encrypt all stored passwords with a strong cryptographic hash.
Set "ENCRYPT_METHOD" in "/etc/login.defs" to "SHA512" by running the following command as a superuser:
# sudo grep -q '^.*ENCRYPT_METHOD' /etc/login.defs && sudo sed -i 's/^.*ENCRYPT_METHOD.*/ENCRYPT_METHOD SHA512/' /etc/login.defs || sudo echo 'ENCRYPT_METHOD SHA512' >> /etc/login.defs
Lock all interactive user accounts not using SHA512 hashing until the passwords can be regenerated.
Verify the SUSE operating system requires the shadow password suite configuration be set to encrypt interactive user passwords using a strong cryptographic hash.
Check that the interactive user account passwords are using a strong password hash with the following command:
# sudo cut -d: -f2 /etc/shadow
$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/
Password hashes "!" or "*" indicate inactive accounts not available for logon and are not evaluated.
If any interactive user password hash does not begin with "$6", this is a finding.
V-77099
False
SLES-12-010220
Verify the SUSE operating system requires the shadow password suite configuration be set to encrypt interactive user passwords using a strong cryptographic hash.
Check that the interactive user account passwords are using a strong password hash with the following command:
# sudo cut -d: -f2 /etc/shadow
$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/
Password hashes "!" or "*" indicate inactive accounts not available for logon and are not evaluated.
If any interactive user password hash does not begin with "$6", this is a finding.
M
2903