STIGQter: STIG Summary: Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The Ubuntu operating system must employ a FIPS 140-2 approved cryptographic hashing algorithms for all created and stored passwords.

DISA Rule

SV-219182r610963_rule

Vulnerability Number

V-219182

Group Title

SRG-OS-000120-GPOS-00061

Rule Version

UBTU-18-010110

Severity

CAT II

CCI(s)

• CCI-000803 - The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Configure the Ubuntu operating system to encrypt all stored passwords with a strong cryptographic hash.

Edit/modify the following line in the file "/etc/pam.d/common-password" file to include the sha512 option for pam_unix.so:

password [success=1 default=ignore] pam_unix.so obscure sha512

Edit/modify /etc/login.defs and set "ENCRYPT_METHOD sha512".

Check Contents

Verify that encrypted passwords stored in /etc/shadow use a strong cryptographic hash.

Check that pam_unix.so auth is configured to use sha512 with the following command:

# grep password /etc/pam.d/common-password | grep pam_unix

password [success=1 default=ignore] pam_unix.so obscure sha512

If "sha512" is not an option of the output, or is commented out, this is a finding.

Check that ENCRYPT_METHOD is set to sha512 in /etc/login.defs:

# grep -i ENCRYPT_METHOD /etc/login.defs

ENCRYPT_METHOD SHA512

If the output does not contain "sha512", or it is commented out, this is a finding.

Vulnerability Number

V-219182

Documentable

False

Rule Version

UBTU-18-010110

Severity Override Guidance

Verify that encrypted passwords stored in /etc/shadow use a strong cryptographic hash.

Check that pam_unix.so auth is configured to use sha512 with the following command:

# grep password /etc/pam.d/common-password | grep pam_unix

password [success=1 default=ignore] pam_unix.so obscure sha512

If "sha512" is not an option of the output, or is commented out, this is a finding.

Check that ENCRYPT_METHOD is set to sha512 in /etc/login.defs:

# grep -i ENCRYPT_METHOD /etc/login.defs

ENCRYPT_METHOD SHA512

If the output does not contain "sha512", or it is commented out, this is a finding.

Check Content Reference

M

Target Key

4055

Comments