>From 5a65f36a7e4a84280821d2752902d65fbf8a379b Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 1 Dec 2012 15:55:55 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/accounts/pam.xml DISA FSO requested updates to RHEL6/input/system/accounts/pam.xml Ticket https://fedorahosted.org/scap-security-guide/ticket/140 Thanks for the copy editing! --- RHEL6/input/system/accounts/pam.xml | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index 1fcf906..ba9a285 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -332,7 +332,7 @@ The DoD requirement is 4. To check how many characters must differ during a password change, run the following command:
$ grep pam_cracklib /etc/pam.d/system-auth
The difok parameter will indicate how many characters must differ. -The DoD requires 4 character differ during a password change. +The DoD requires four characters differ during a password change. This would appear as difok=4. @@ -401,7 +401,7 @@ line which refers to the pam_unix.so module, as shown:
password sufficient pam_unix.so existing_options remember=24
The DoD requirement is 24 passwords. -To verify that the password reuse setting is compliant, run the following command: +To verify the password reuse setting is compliant, run the following command:
$ grep remember /etc/pam.d/system-auth
The output should show the following at the end of the line:
remember=24
@@ -428,9 +428,9 @@ locations. In /etc/pam.d/system-auth, the password section of the file controls which PAM modules execute during a password change. Set the pam_unix.so module in the -password section to include the argument sha512, as shown here: +password section to include the argument sha512, as shown below:
password    sufficient    pam_unix.so sha512 other arguments...
-This will help ensure that when local users change their passwords, hashes for the new +This will help ensure when local users change their passwords, hashes for the new passwords will be generated using the SHA-512 algorithm. This is the default. @@ -453,7 +453,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul Set Password Hashing Algorithm in /etc/login.defs In /etc/login.defs, add or correct the following line to ensure -that the system will use SHA-512 as the hashing algorithm: +the system will use SHA-512 as the hashing algorithm:
ENCRYPT_METHOD SHA512
@@ -472,8 +472,8 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul Set Password Hashing Algorithm in /etc/libuser.conf -In /etc/libuser.conf, add or correct the the following line in its -[defaults] section to ensure that the system will use the SHA-512 +In /etc/libuser.conf, add or correct the following line in its +[defaults] section to ensure the system will use the SHA-512 algorithm for password hashing:
crypt_style = sha512
-- 1.7.1