andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

make sha rounds configurable and increase no of rounds (#452)

Browse Source 
* make sha rounds configurable and increase no of rounds

Fixes #365

Signed-off-by: rndmh3ro <[email protected]>

* Prettified Code!

* make password rounds configurable in pam system-auth

Signed-off-by: rndmh3ro <[email protected]>

* change wording of sha rounds documentation

Co-authored-by: schurzi <[email protected]>

Co-authored-by: schurzi <[email protected]>
This commit is contained in:
Sebastian Gumprichandschurzi authored and GitHub committed 2021-06-30 10:41:59 +02:00
1 parent c769db4221
commit 9cefddd949
4 files changed
+16 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/os_hardening/templates/etc/login.defs.j2
+3 -3
View File
@@ -170,11 +170,11 @@ MD5_CRYPT_ENAB no
ENCRYPT_METHOD SHA512
# Only used if `ENCRYPT_METHOD` is set to `SHA256` or `SHA512`: Define the number of SHA rounds.
# With a lot of rounds, it is more difficult to brute forcing the password. But note also that it more CPU resources will be needed to authenticate users.
# With a lot of rounds brute forcing the password is more difficult. But note also that it more CPU resources will be needed to authenticate users.
# If not specified, the libc will choose the default number of rounds (5000). The values must be inside the 1000-999999999 range. If only one of the MIN or MAX values is set, then this value will be used.
# If MIN > MAX, the highest value will be used.
#SHA_CRYPT_MIN_ROUNDS 5000
#SHA_CRYPT_MAX_ROUNDS 5000
SHA_CRYPT_MIN_ROUNDS {{ os_sha_crypt_min_rounds }}
SHA_CRYPT_MAX_ROUNDS {{ os_sha_crypt_max_rounds }}
# Obsoleted by PAM
roles/os_hardening/templates/etc/pam.d/rhel_auth.j2
+1 -1
View File
@@ -38,7 +38,7 @@ password requisite pam_pwquality.so {{ os_auth_pam_pwquality_options }}
{# NSA 2.3.3.6 Limit Password Reuse #}
password requisite pam_pwhistory.so remember=5 use_authtok
{# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512 #}
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok rounds={{ os_sha_crypt_min_rounds }}
{% if (os_auth_pam_sssd_enable | bool) %}
password sufficient pam_sss.so use_authtok
{% endif %}