# Ensure strong password hashing algorithm is configured

The necessity of using a strong cryptographic hash for storing passwords cannot be overstated. When a user's password hash is compromised, a weak algorithm (like MD5 or DES) allows an attacker to quickly crack the password using techniques like rainbow tables or brute-force attacks. This exposes user accounts and potentially the entire system. Enforcing a strong algorithm like SHA-512 makes offline password cracking computationally infeasible with current technology, thus protecting credentials even if the password database is stolen. The audit script verifies this configuration by reading the 'crypt_style' parameter from '/etc/libuser.conf', which dictates the default hashing algorithm for new user accounts. The remediation script directly configures this parameter to enforce a specific algorithm. The recommended state for Basic, Moderate, and Strict levels is 'sha512' because it is the recognized security standard for this operating system generation, as recommended by CIS Benchmarks. It provides a robust defense against modern password cracking efforts. While newer algorithms exist on more recent systems, SHA-512 is the strongest, most widely supported option for CentOS 7 and later within its lifecycle, making it the appropriate and secure choice for all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['sha512']` |
| **Moderate** | `['sha512']` |
| **Strict** | `['sha512']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that inspects the '/etc/libuser.conf' file. The script must parse the '[defaults]' section to find the value of the 'crypt_style' parameter. It should output only the value of this parameter (e.g., 'sha512'), with no additional text or formatting.

## Remediation Script Working

shell script that accepts one positional argument, which is the desired password hashing algorithm (e.g., 'sha512'). The script must modify the '/etc/libuser.conf' file, setting the 'crypt_style' parameter under the '[defaults]' section to the provided argument. If the parameter does not exist, it should be added. The script must output 'true' on successful modification and 'false' on failure.

