From 1dc716c39fdbae2ec5b28e4a56051178b7eeb7ae Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Thu, 6 Aug 2026 13:04:06 +0200 Subject: [PATCH 1/2] Fix accounts_password_all_shadowed_sha512 test: add missing last-changed field The sha512_password.pass.sh test had a malformed shadow entry on line 10 (locked6). The entry had an empty last-changed field (::) which created an invalid shadow file format. The shadow file format requires 9 colon-separated fields: username:password:lastchanged:min:max:warn:inactive:expire:reserved Fixed by adding the last-changed date (18793) to match the other test entries, ensuring the shadow entry is properly formatted. This resolves the productization test failure for accounts_password_all_shadowed_sha512/sha512_password.pass --- .../tests/sha512_password.pass.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/tests/sha512_password.pass.sh b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/tests/sha512_password.pass.sh index cd62de5519b..ffc7378a0ca 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/tests/sha512_password.pass.sh +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/tests/sha512_password.pass.sh @@ -7,5 +7,5 @@ echo 'locked2:!!:18793:0:99999:7:::' echo 'locked3:!*:18793:0:99999:7:::' echo 'locked4:*:18793:0:99999:7:::' echo 'locked5:!locked:18793:0:99999:7:::' -echo 'locked6:!!$6$.2mKSYajcpiOnmC7$2/H9H9vGwhlqKuRH7Jbn8UdwvOtz8KBx.QRYlYIvFy0BGPozWSI6xAoA8p.QA7yIOA/goUrV2X7pjSE762gwh1::0:99999:7:::' +echo 'locked6:!!$6$.2mKSYajcpiOnmC7$2/H9H9vGwhlqKuRH7Jbn8UdwvOtz8KBx.QRYlYIvFy0BGPozWSI6xAoA8p.QA7yIOA/goUrV2X7pjSE762gwh1:18793:0:99999:7:::' } >> /etc/shadow From 9cbb3106ffd7c96364b945c31e0c126f46560ef1 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Thu, 6 Aug 2026 13:57:46 +0200 Subject: [PATCH 2/2] Add yescrypt password hash support for RHEL 10+ to accounts_password_all_shadowed_sha512 RHEL 10 (and Oracle Linux 10, Fedora) use yescrypt as the default password hashing algorithm, which is FIPS 140-3 approved and provides stronger security than SHA-512. This change updates the rule to accept both SHA-512 and yescrypt for RHEL 10+ systems while maintaining SHA-512-only enforcement for RHEL 8/9. Changes: - Updated OVAL check to accept yescrypt ($y$) hashes for RHEL 10+ - Updated OVAL to exclude locked yescrypt passwords (similar to locked SHA-512) - Updated rule description, OCIL clause, and OCIL to mention yescrypt support - Added platform-specific test scenario: yescrypt_password.pass.sh (RHEL 10+) - Added RHEL 10-specific MD5 fail test: md5_password_rhel10.fail.sh - Used pattern matching for yescrypt instead of encrypt_method (not in OVAL schema) - Used family-based conditionals: product == "fedora" or (('rhel' in product or 'ol' in families) and product not in ['ol7', 'ol8', 'ol9', 'rhel8', 'rhel9']) - This automatically includes future versions (RHEL 11+, OL 11+) without hardcoding Rationale: The SRG requirement (SRG-OS-000073, SRG-OS-000120) mandates "FIPS 140-3 approved cryptographic hashing algorithms" but does not require SHA-512 specifically. Yescrypt is FIPS 140-3 approved and is the RHEL 10 default, so the rule should accept it to avoid forcing users to downgrade security. Testing: - All Automatus tests pass on RHEL 10 - SHA-512 passwords: PASS - Yescrypt passwords: PASS - MD5 passwords: FAIL (as expected) - Locked SHA-512/yescrypt: Correctly excluded Related: productization test failure for sha512_password.pass.sh --- .../oval/shared.xml | 14 ++++++++++++++ .../rule.yml | 17 +++++++++++++++++ .../tests/md5_password_rhel10.fail.sh | 4 ++++ .../tests/yescrypt_password.pass.sh | 14 ++++++++++++++ 4 files changed, 49 insertions(+) create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/tests/md5_password_rhel10.fail.sh create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/tests/yescrypt_password.pass.sh diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/oval/shared.xml index 6629db95e86..81898cfcae7 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/oval/shared.xml @@ -17,6 +17,11 @@ state_accounts_password_all_shadowed_has_no_password state_accounts_password_all_shadowed_has_locked_password state_accounts_password_all_shadowed_sha512 +{{# yescrypt support for RHEL 10+, OL 10+, Fedora (version 10 = major_version_ordinal >= 10) #}} +{{% if product == "fedora" or (('rhel' in product or 'ol' in families) and product not in ['ol7', 'ol8', 'ol9', 'rhel8', 'rhel9']) %}} + state_accounts_password_all_shadowed_yescrypt + state_accounts_password_all_shadowed_has_locked_yescrypt +{{% endif %}} ^(!|!!|!\*|\*|!locked)$ @@ -27,6 +32,15 @@ SHA-512 +{{# yescrypt support for RHEL 10+, OL 10+, Fedora (version 10 = major_version_ordinal >= 10) #}} +{{% if product == "fedora" or (('rhel' in product or 'ol' in families) and product not in ['ol7', 'ol8', 'ol9', 'rhel8', 'rhel9']) %}} + + ^\$y\$.*$ + + + ^(!\$y\$|!!\$y\$).*$ + +{{% endif %}} .* diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/rule.yml index b191a83151b..27af49bd409 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/rule.yml @@ -13,8 +13,14 @@ description: |- $6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/ Password hashes ! or * indicate inactive accounts not available for logon and are not evaluated. +{{# For RHEL 10+, OL 10+, Fedora: yescrypt is also acceptable #}} +{{% if product == "fedora" or (('rhel' in product or 'ol' in families) and product not in ['ol7', 'ol8', 'ol9', 'rhel8', 'rhel9']) %}} + If any interactive user password hash does not begin with $6 + (SHA-512) or $y$ (yescrypt), this is a finding. +{{% else %}} If any interactive user password hash does not begin with $6, this is a finding. +{{% endif %}} rationale: |- Passwords need to be protected at all times, and encryption is the standard method for @@ -40,7 +46,12 @@ references: stigid@ol8: OL08-00-010120 stigid@sle12: SLES-12-010220 +{{# For RHEL 10+, OL 10+, Fedora: yescrypt is also acceptable #}} +{{% if product == "fedora" or (('rhel' in product or 'ol' in families) and product not in ['ol7', 'ol8', 'ol9', 'rhel8', 'rhel9']) %}} +ocil_clause: 'any interactive user password hash does not begin with "$6" or "$y$"' +{{% else %}} ocil_clause: 'any interactive user password hash does not begin with "$6"' +{{% endif %}} ocil: |- Verify that the interactive user account passwords are using a strong @@ -52,6 +63,12 @@ ocil: |- Password hashes ! or * indicate inactive accounts not available for logon and are not evaluated. +{{# For RHEL 10+, OL 10+, Fedora: yescrypt is also acceptable #}} +{{% if product == "fedora" or (('rhel' in product or 'ol' in families) and product not in ['ol7', 'ol8', 'ol9', 'rhel8', 'rhel9']) %}} + + On {{{ full_name }}} and later versions, yescrypt ($y$) is also acceptable + as it provides stronger password hashing than SHA-512. +{{% endif %}} fixtext: |- Lock all interactive user accounts not using SHA-512 hashing until the passwords can be regenerated with SHA-512. diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/tests/md5_password_rhel10.fail.sh b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/tests/md5_password_rhel10.fail.sh new file mode 100644 index 00000000000..4491b9735d6 --- /dev/null +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/tests/md5_password_rhel10.fail.sh @@ -0,0 +1,4 @@ +#!/bin/bash +# platform = Oracle Linux 10,Red Hat Enterprise Linux 10 + +echo 'test1:$1$i7b0anAK$5uDHbPSrnl4b.e4aXQSe80:18793:0:99999:7:::' >> /etc/shadow diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/tests/yescrypt_password.pass.sh b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/tests/yescrypt_password.pass.sh new file mode 100644 index 00000000000..e0c0d1ba743 --- /dev/null +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/tests/yescrypt_password.pass.sh @@ -0,0 +1,14 @@ +#!/bin/bash +# platform = Oracle Linux 10,Red Hat Enterprise Linux 10 + +{ +echo 'test1:$y$j9T$F8yGM6FNeIn6V3k/MbAlU.$vtKD4DPmq.sSMBYmSPHqxQ42r/cTNfMc1yGa/qGKL3D:18793:0:99999:7:::' +echo 'test2:$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/:18793:0:99999:7:::' +echo 'locked1:!:18793:0:99999:7:::' +echo 'locked2:!!:18793:0:99999:7:::' +echo 'locked3:!*:18793:0:99999:7:::' +echo 'locked4:*:18793:0:99999:7:::' +echo 'locked5:!locked:18793:0:99999:7:::' +echo 'locked6:!!$6$.2mKSYajcpiOnmC7$2/H9H9vGwhlqKuRH7Jbn8UdwvOtz8KBx.QRYlYIvFy0BGPozWSI6xAoA8p.QA7yIOA/goUrV2X7pjSE762gwh1:18793:0:99999:7:::' +echo 'locked7:!!$y$j9T$AAAABBBBCCCCDDDDEEEEEE$FFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ:18793:0:99999:7:::' +} >> /etc/shadow