openstack/ansible-hardening
Code Issues Proposed changes
ansible-hardening/doc/source/developer-notes/V-38577.rst
Major Hayden a841e184de Docs: Update dev notes for Cat 2 controls 
This patch updates the documentation for the developer notes associated
with the Cat 2 (Medium) controls applied by the security role.

Partial-bug: 1583744

Change-Id: Ic342f33942521db009185585a21208a4688f6ed3
2016-05-25 11:38:13 -05:00

816 B
Raw Blame History

The STIG requires SHA512 to be used for hashing password since it is in the list of FIPS 140-2 approved hashing algorithms. This is also the default in Ubuntu 14.04, Ubuntu 16.04, and CentOS 7.

The libuser package isn't installed by default in Ubuntu or via openstack-ansible. The Ansible tasks will do the following:

  • Check to see if libuser is installed
  • If it's installed, it will check for the password hashing algorithm in /etc/libuser.conf
  • If libuser is installed and the password hashing algorithm isn't SHA512, an error will be printed and the playbook will fail

Further reading: