← Back to Solaris 11 x86 Security Technical Implementation Guide

V-216098

CAT II (Medium)

Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors.

Rule ID

SV-216098r603268_rule

STIG

Solaris 11 x86 Security Technical Implementation Guide

Version

V2R10

CCIs

V-48243

Discussion

Cryptographic hashes provide quick password authentication while not actually storing the password.

Check Content

Determine which cryptographic algorithms are configured.

# grep ^CRYPT /etc/security/policy.conf

If the command output does not include the lines:

CRYPT_DEFAULT=6
CRYPT_ALGORITHMS_ALLOW=5,6

this is a finding.

Fix Text

The root role is required.

Configure the system to disallow the use of UNIX encryption and enable SHA256 as the default encryption hash.

# pfedit /etc/security/policy.conf

Check that the lines:
CRYPT_DEFAULT=6
CRYPT_ALGORITHMS_ALLOW=5,6

exist and are not commented out.