The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm.

From Solaris 10 X86 Security Technical Implementation Guide

Associated with IA controls: IAIA-2, DCNR-1, IAIA-1

Associated with: CCI-000196

SV-40790r1_rule The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm.

Vulnerability discussion

Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors. The use of unapproved algorithms may result in weak password hashes more vulnerable to compromise.

Check content

Fix text

If the /etc/security/crypt.conf file does not support FIPS 140-2 approved cryptographic hashing algorithms, upgrade to at least the Solaris 10 8/07 release. Edit the /etc/security/policy.conf file. # vi /etc/security/policy.conf Uncomment the CRYPT_ALGORITHMS_DEPRECATE line and set it to "__unix__". Update the CRYPT_DEFAULT default line to be equal to 5 or 6. The following lines are acceptable. CRYPT_ALGORITHMS_DEPRECATE=__unix__ CRYPT_DEFAULT=6 Update passwords for all accounts with non-compliant password hashes.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.