cis-ubuntu2004-v300-5-4-1-4

name	cis-ubuntu2004-v300-5-4-1-4
description	Ensure strong password hashing algorithm is configured
category	cis-iam
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","users","authentication"]
cis_id	5.4.1.4
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.4.1.4 Ensure strong password hashing algorithm is configured (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

A cryptographic hash function converts an arbitrary-length input into a fixed length output. Password hashing performs a one-way transformation of a password, turning the password into another string, called the hashed password.

ENCRYPT_METHOD (string) - This defines the system default encryption algorithm for encrypting passwords (if no algorithm are specified on the command line). It can take one of these values:

• MD5 - MD5-based algorithm will be used for encrypting password
• SHA256 - SHA256-based algorithm will be used for encrypting password
• SHA512 - SHA512-based algorithm will be used for encrypting password
• BCRYPT - BCRYPT-based algorithm will be used for encrypting password
• YESCRYPT - YESCRYPT-based algorithm will be used for encrypting password
• DES - DES-based algorithm will be used for encrypting password (default)

Note:

• This parameter overrides the deprecated MD5_CRYPT_ENAB variable.
• This parameter will only affect the generation of group passwords.
• The generation of user passwords is done by PAM and subject to the PAM configuration.
• It is recommended to set this variable consistently with the PAM configuration.

Rationale

The SHA-512 and yescrypt algorithms provide a stronger hash than other algorithms used by Linux for password hash generation. A stronger hash provides additional protection to the system by increasing the level of effort needed for an attacker to successfully determine local group passwords.

Audit Procedure

Command Line

Run the following command to verify the hashing algorithm is sha512 or yescrypt in /etc/login.defs:

# grep -Pi -- '^\h*ENCRYPT_METHOD\h+(SHA512|yescrypt)\b' /etc/login.defs

Example output:

ENCRYPT_METHOD SHA512
- OR -
ENCRYPT_METHOD   YESCRYPT

Expected Result

Output should show ENCRYPT_METHOD set to SHA512 or YESCRYPT.