Set Password Hashing Algorithm in /etc/login.defs
Ensures ENCRYPT_METHOD in /etc/login.defs is set to SHA512, so new password hashes use a strong algorithm.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Passwords must be protected at all times, and hashing is the standard method for protecting them. A password hashed with a weak algorithm is no better protected than plaintext. Setting ENCRYPT_METHOD to SHA512 ensures new and changed passwords use a strong hash, making offline password-cracking attacks far more expensive.
What Pavois checks
Pavois uses the InSpec login_defs resource to read the effective resolved value of ENCRYPT_METHOD, parsing /etc/login.defs as the password tools actually interpret it (last setting wins, comments ignored). This reflects the value passwd/chpasswd will use, rather than a naive grep that could match a commented or overridden line.
describe login_defs do
its('ENCRYPT_METHOD') { should match(/\A(SHA512|YESCRYPT)\z/i) }
endHow to verify it is applied
grep -i '^ENCRYPT_METHOD' /etc/login.defsshould printENCRYPT_METHOD SHA512.- After setting a new password,
getent shadow <user>should show a hash starting with$6$(SHA512).
Inspect & investigate
grep -i ENCRYPT_METHOD /etc/login.defsshows the configured algorithm.getent shadow <user>reveals the actual hash prefix ($6$= SHA512,$y$= yescrypt).journalctl /usr/sbin/sshd//var/log/auth.logrecord password change events via PAM.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: set ENCRYPT_METHOD SHA512 in /etc/login.defs (or rely on the PAM pam_unix sha512/yescrypt default on modern distros). The change affects only passwords set or changed afterward; existing hashes are not rehashed until each user next changes their password.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/login.defs |
|---|---|
| key | ENCRYPT_METHOD |
| resource | conf_line |
| sep | space |
| value | YESCRYPT |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Negligible operational risk, SHA512 is the default on all supported distros. Note: the change is forward-only, so existing accounts keep their old hash until next password change; force a rotation if you need every account compliant immediately. On distros defaulting to yescrypt ($y$), confirm your policy accepts SHA512 vs yescrypt before forcing this value.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.4.1.4, 8.3.2 | direct | per OS, see the benchmark table | high |
| NIST | 3.13.11, CM-6(a), IA-5(1)(c), IA-5(c) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 8.3.2 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-611070, UBTU-24-400400 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.