common: users/pam: increase the number of rounds for hashing group pa…

…sswords - fixes #807 - ref. dev-sec/ansible-collection-hardening#365 - ref. https://cisofy.com/lynis/controls/AUTH-9230/
nodiscc · Sep 1, 2022 · f50b54e · f50b54e
1 parent 7a8c3a3
commit f50b54e
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 4 deletions.
diff --git a/roles/common/templates/etc_login.defs.j2 b/roles/common/templates/etc_login.defs.j2
@@ -290,8 +290,8 @@ ENCRYPT_METHOD SHA512
 # If only one of the MIN or MAX values is set, then this value will be used.
 # If MIN > MAX, the highest value will be used.
 #
-# SHA_CRYPT_MIN_ROUNDS 5000
-# SHA_CRYPT_MAX_ROUNDS 5000
+SHA_CRYPT_MIN_ROUNDS 10000
+SHA_CRYPT_MAX_ROUNDS 65536
 
 ################# OBSOLETED BY PAM ##############
 #						#

diff --git a/roles/konstruktoid.hardening/templates/etc/login.defs.j2 b/roles/konstruktoid.hardening/templates/etc/login.defs.j2
@@ -1,5 +1,3 @@
-SHA_CRYPT_MAX_ROUNDS 65536
-SHA_CRYPT_MIN_ROUNDS 10000
 SU_NAME su
 SYSLOG_SG_ENAB yes
 SYSLOG_SU_ENAB yes