Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors.

Cryptographic hashes provide quick password authentication while not actually storing the password.

Determine which cryptographic algorithms are configured.

# grep ^CRYPT /etc/security/policy.conf

If the command output does not include the lines, this is a finding.

CRYPT_DEFAULT=6 CRYPT_ALGORITHMS_ALLOW=5,6

The root role is required.

Configure the system to disallow the use of UNIX encryption and enable SHA256 as the default encryption hash.

# pfedit /etc/security/policy.conf

Check that the following lines exist and are not commented out: CRYPT_DEFAULT=6 CRYPT_ALGORITHMS_ALLOW=5,6