accounts_password_all_shadowed_sha512: Fix test file and add yescrypt support for RHEL 10+ - #14967
Open
ggbecker wants to merge 2 commits into
Open
accounts_password_all_shadowed_sha512: Fix test file and add yescrypt support for RHEL 10+#14967ggbecker wants to merge 2 commits into
ggbecker wants to merge 2 commits into
Conversation
…ged field The sha512_password.pass.sh test had a malformed shadow entry on line 10 (locked6). The entry had an empty last-changed field (::) which created an invalid shadow file format. The shadow file format requires 9 colon-separated fields: username:password:lastchanged:min:max:warn:inactive:expire:reserved Fixed by adding the last-changed date (18793) to match the other test entries, ensuring the shadow entry is properly formatted. This resolves the productization test failure for accounts_password_all_shadowed_sha512/sha512_password.pass
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
This datastream diff is auto generated by the check Click here to see the full diffNew content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed_sha512'.
--- xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed_sha512
+++ xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed_sha512
@@ -14,8 +14,10 @@
$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/
Password hashes ! or * indicate inactive accounts not
available for logon and are not evaluated.
-If any interactive user password hash does not begin with $6,
-this is a finding.
+
+
+If any interactive user password hash does not begin with $6
+(SHA-512) or $y$ (yescrypt), this is a finding.
[reference]:
IA-5(1)(c)
OCIL for rule 'xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed_sha512' differs.
--- ocil:ssg-accounts_password_all_shadowed_sha512_ocil:questionnaire:1
+++ ocil:ssg-accounts_password_all_shadowed_sha512_ocil:questionnaire:1
@@ -7,5 +7,10 @@
Password hashes ! or * indicate inactive accounts not
available for logon and are not evaluated.
- Is it the case that any interactive user password hash does not begin with "$6"?
+
+
+
+On Fedora and later versions, yescrypt ($y$) is also acceptable
+as it provides stronger password hashing than SHA-512.
+ Is it the case that any interactive user password hash does not begin with "$6" or "$y$"?
|
…all_shadowed_sha512
RHEL 10 (and Oracle Linux 10, Fedora) use yescrypt as the default password
hashing algorithm, which is FIPS 140-3 approved and provides stronger security
than SHA-512. This change updates the rule to accept both SHA-512 and yescrypt
for RHEL 10+ systems while maintaining SHA-512-only enforcement for RHEL 8/9.
Changes:
- Updated OVAL check to accept yescrypt ($y$) hashes for RHEL 10+
- Updated OVAL to exclude locked yescrypt passwords (similar to locked SHA-512)
- Updated rule description, OCIL clause, and OCIL to mention yescrypt support
- Added platform-specific test scenario: yescrypt_password.pass.sh (RHEL 10+)
- Used pattern matching for yescrypt instead of encrypt_method (not in OVAL schema)
- Used family-based conditionals: product == "fedora" or (('rhel' in product or
'ol' in families) and product not in ['ol7', 'ol8', 'ol9', 'rhel8', 'rhel9'])
- This automatically includes future versions (RHEL 11+, OL 11+) without hardcoding
Rationale:
The SRG requirement (SRG-OS-000073, SRG-OS-000120) mandates "FIPS 140-3 approved
cryptographic hashing algorithms" but does not require SHA-512 specifically.
Yescrypt is FIPS 140-3 approved and is the RHEL 10 default, so the rule should
accept it to avoid forcing users to downgrade security.
Testing:
- All Automatus tests pass on RHEL 10
- SHA-512 passwords: PASS
- Yescrypt passwords: PASS
- MD5 passwords: FAIL (as expected)
- Locked SHA-512/yescrypt: Correctly excluded
Related: productization test failure for sha512_password.pass.sh
ggbecker
force-pushed
the
worktree-fix-sha512-test
branch
from
August 10, 2026 11:47
9cbb310 to
ffde553
Compare
Member
Author
|
test results: |
ggbecker
marked this pull request as ready for review
August 10, 2026 12:03
ggbecker
requested review from
Mab879,
jan-cerny,
matusmarhefka and
vojtapolasek
as code owners
August 10, 2026 12:03
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
Member
Author
|
Here the only question that remains is that the rule alludes to sha512 and introducing a new yescript algorithm might open the interpretation of the rule. But I didn't want to create yet another rule since both parameters should be safe. The question will probably be to influence the policy makers to accept this new parameter too. |
Mab879
requested changes
Aug 10, 2026
Mab879
left a comment
Mab879
left a comment
Member
There was a problem hiding this comment.
Per DISA yescrypt is not FIPS 140-3 approved (the underlying hashing is, yescrypt itself is not) , all passwords must be SHA 512. So we will need figure some else out.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Fixes two issues with the
accounts_password_all_shadowed_sha512rule:Rationale:
accounts_password_all_shadowed_sha512/sha512_password.passfails in daily productization #14832Test file fix:
The
sha512_password.pass.shtest had an invalid shadow entry with an empty field, causing test failures.Yescrypt support:
RHEL 10 uses yescrypt as the default password hashing algorithm instead of SHA-512. Both are FIPS 140-3 approved, but without this change, RHEL 10 systems would fail STIG checks despite using stronger security. The implementation uses family-based conditionals to automatically support future RHEL/OL versions.
Technical note: The OVAL Unix schema doesn't include
yescryptin theencrypt_methodenumeration, so the implementation uses password pattern matching instead.Review Hints:
Test on RHEL 10: