cyberstrikeus CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 4.4.4
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Description
The commands below change password encryption from md5 to yescrypt (a much stronger hashing algorithm). All existing accounts will need to perform a password change to upgrade the stored hashes to the new algorithm.
Rationale
The yescrypt algorithm provides much stronger hashing than MD5, which provides protection of the password file even in the event of a system compromise. Note: these changes only apply to accounts configured on the local system.
Audit Procedure
Command Line
Run the following command to verify the password hashing algorithm is configured:
grep -Pi '^\h*password\h+(\S+\h+)+pam_unix\.so\h+([^#\n\r]+\h+)?(sha512|yescrypt)\b' /etc/pam.d/common-password
Expected Result
Output should include sha512 or yescrypt.
Also verify login.defs:
grep -Pi '^\h*ENCRYPT_METHOD\h+(SHA512|yescrypt)\b' /etc/login.defs
Remediation
Command Line
Edit /etc/pam.d/common-password to include sha512 or yescrypt option to the pam_unix.so line:
password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt
Edit /etc/login.defs to set:
ENCRYPT_METHOD yescrypt
Default Value
ENCRYPT_METHOD SHA512 (in /etc/login.defs)
References
- NIST SP 800-53 Rev. 5: IA-5(1)
CIS Controls
v8 - 3.11 Encrypt Sensitive Data at Rest - Encrypt sensitive data at rest on servers, applications, and databases containing sensitive data.
v7 - 16.4 Encrypt or Hash All Authentication Credentials.
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Assessment Status
Automated