Check Details

• Resource: Server
• Check: Ensure password hashing algorithm is SHA-512
• Risk: Weak algorithms (e.g., MD5) can lead to password compromise.

Remediation Steps

1. Log in to the server with root or sudo privileges.
2. Open and update PAM configuration files based on your OS.

3. For Ubuntu/Debian systems:

   

   sudo nano /etc/pam.d/common-password
   

   Ensure the following line exists (modify if needed):

   

   password required pam_unix.so sha512 shadow use_authtok
   

4. For RHEL/CentOS systems (IMPORTANT: update BOTH files):

   Edit system-auth:

   

   sudo nano /etc/pam.d/system-auth
   

   Edit password-auth:

   

   sudo nano /etc/pam.d/password-auth
   

   In BOTH files, ensure:

   

   password required pam_unix.so sha512 shadow use_authtok
   

5. Save all files and exit the editor.

6. Verify configuration is correctly applied:

   

   grep -E "pam_unix.so.*sha512" /etc/pam.d/*
   

   Ensure output shows sha512 in all relevant PAM files.

7. Force all users to reset passwords so SHA-512 hashing is applied:

   

   awk -F: '($3>=1000)&&($1!="nobody"){print $1}' /etc/passwd | xargs -n 1 chage -d 0
   

8. Verify new passwords are using SHA-512:

   

   sudo grep '^$6$' /etc/shadow
   

   Output starting with $6$ confirms SHA-512 hashing.