search

dsglaser / cis-security

Playbooks to implement Center for Internet Security (CIS) controls for RHEL (7-9), RHEL Clones, Ubuntu (18.04-22.04), and Microsoft Windows (10, Server 2019)
Other
90 stars 63 forks source link

5.5.4 - password_hash_alg- RHEL8 #66

Closed osullivanm-csi closed 1 year ago

osullivanm-csi commented 1 year ago

password_hash_alg is set to 'yescrypt' but to pass it needs to be 'sha512'

dsglaser commented 1 year ago

When you say 'to pass', the control sets it to one or the other and the control calls for either. I'm not sure what you mean.

osullivanm-csi commented 1 year ago

I am running a CIS CAT to assess compliance and it is failing because it isn't sha512. Just double checked CIS and the check is now:

"5.5.4 Ensure password hashing algorithm is SHA-512"

dsglaser commented 1 year ago

Ok, I didn't notice that there was a mismatch:

RHEL Enterprise 9 v1.0.0 : 5.5.4 - Ensure password hashing algorithm is SHA-512 or yescrypt RHEL Enterprise 8 v2.0.0 : 5.5.4 - Ensure password hashing algorithm is SHA-512 Ubunto 22.04 LTS v1.0.0 : 5.5.4 - Ensure password hashing algorithm is up to date with the latest standards (describes setting to yescrypt in the text)

I will change RHEL 8 to just SHA-512

dsglaser commented 1 year ago

Fixes are in dev branch

dsglaser commented 1 year ago

merged into master