Change default hashing algorithm settings in ANSSI profiles for RHEL #12127
Conversation
ANSSI allows two hashing algorithms with pam_unix.so, sha512 and yescrypt. Currently, RHEL products use sha512 by default, which is already compliant so the respective ANSSI profiles were updated to check for sha512 instead of yescrypt. This will better align to system default settings and avoid unnecessary changes. Signed-off-by: Marcus Burghardt <[email protected]>
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
Start a new ephemeral environment with changes proposed in this pull request: Fedora Environment Oracle Linux 8 Environment |
|
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
|
Code Climate has analyzed commit 0effad1 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 59.4% (0.0% change). View more on Code Climate. |
Description:
ANSSI allows two hashing algorithms with
pam_unix.so:sha512andyescrypt.Currently, RHEL products use
sha512by default, which is already compliant.Therefore, the respective ANSSI profiles were updated to check for
sha512values instead ofyescrypt.This will better align to system default settings and avoid unnecessary changes.
Rationale:
Review Hints:
After applying the remediation for
accounts_password_pam_unix_rounds_system_authrule from ANSSI profiles for RHEL, the number ofroundsconfigured for pam_unix.so in/etc/pam.d/system-authis now appropriated tosha512.The most relevant variable is
var_password_pam_unix_roundsbut I also updatedvar_password_hashing_algorithmvariable option to ensure/etc/login.defsis also aligned with default settings.