# Ensure strong password hashing algorithm is configured

Necessity: The choice of password hashing algorithm is critical for protecting user credentials against offline attacks. If an attacker gains access to the `/etc/shadow` file, a weak algorithm (like MD5 or DES) allows them to crack the stored password hashes relatively quickly using brute-force or rainbow table attacks. Modern, strong algorithms like `sha512` and `yescrypt` are computationally intensive, significantly increasing the time and resources required to crack a single password, thereby protecting user accounts even after a system breach. `yescrypt` is specifically designed to be memory-hard, making it more resistant to cracking attempts using specialized hardware like GPUs and ASICs.

Auditing and Remediation: The audit script inspects the `ENCRYPT_METHOD` parameter within the `/etc/login.defs` file to determine the default hashing algorithm used for newly created passwords or when existing users change their passwords. The remediation script modifies this parameter to enforce the use of a more secure algorithm, ensuring that all future password hashes are created with the stronger protection.

Recommended State Rationale:
- Basic: `['sha512']` is recommended as a strong baseline. It is a widely adopted standard from the SHA-2 family and offers substantial protection compared to legacy algorithms.
- Moderate: `['yescrypt']` is recommended for a moderate level of security. It is the default on many modern Linux distributions and is a memory-hard algorithm designed to be highly resistant to parallelized cracking attempts on modern hardware, offering a significant security advantage over `sha512`.
- Strict: `['yescrypt']` is also the recommendation for the strictest security level, as it is currently the most secure and robust algorithm available in the standard `libcrypt` library for this purpose. Enforcing `yescrypt` ensures the highest practical level of protection against offline password cracking.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['sha512']` |
| **Moderate** | `['yescrypt']` |
| **Strict** | `['yescrypt']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that queries the `/etc/login.defs` file for the value of `ENCRYPT_METHOD`. The script must output only the value (e.g., 'yescrypt' or 'sha512'), with no extra text or labels.

## Remediation Script Working

bash script that accepts a single positional argument specifying the desired password hashing algorithm. The script must update the `ENCRYPT_METHOD` setting in `/etc/login.defs` to the provided value. If the setting does not exist, it should be added. The script must return `true` on success and `false` on failure.

