mediumaccess-controlverified ✓

Store passwords using a SHA-512 hash via PAM

pam-password-sha512-common · UBUNTU ≥ 22 · 1 impl

Description

The pam_unix.so line in /etc/pam.d/common-password must use the sha512 hashing algorithm, and where a rounds value is set it must be at least 100000, so that stored password representations are strongly hashed.

Rationale

Storing only strongly hashed representations of passwords protects them if the shadow database is exposed. On Debian-family systems the password hashing algorithm is selected on the pam_unix.so line in common-password.

Check → Remediate

Checkcommand

line=$(grep -E '^[^#]*pam_unix\.so' /etc/pam.d/common-password 2>/dev/null | head -1)
[ -n "$line" ] || { echo "FAIL: no active pam_unix.so line in common-password"; exit 1; }
printf '%s\n' "$line" | grep -qw sha512 || { echo "FAIL: sha512 missing from pam_unix.so line"; exit 1; }
# STIG: a finding only if rounds IS set and is below 100000.
r=$(printf '%s\n' "$line" | grep -oE 'rounds=[0-9]+' | grep -oE '[0-9]+' | head -1)
if [ -n "$r" ]; then
  [ "$r" -ge 100000 ] 2>/dev/null || { echo "FAIL: rounds=$r is below 100000"; exit 1; }
fi
echo "OK: pam_unix.so uses sha512${r:+ rounds=$r}"; exit 0

expected_exit:: 0

Remediatemanual

note:: Set the pam_unix.so line in /etc/pam.d/common-password to use sha512, e.g. 'password [success=1 default=ignore] pam_unix.so obscure sha512 shadow rounds=100000'.

Framework references

STIG

V-270725 / UBTU-24-400220V-260569 / UBTU-22-611055

NIST 800-53

IA-5(1)

Live verification

ubuntu22:checkubuntu24:check

#pam#password#sha512#hashing#stig