LowOS hardeningBLWK-ACCT-004

Password hashing rounds are not explicitly configured

What this means

This host hashes passwords with SHA-512/256 (ENCRYPT_METHOD), but SHA_CRYPT_MIN_ROUNDS isn't set in /etc/login.defs, so new passwords get whatever the system's compiled-in default hashing cost is rather than a deliberately chosen one — fine until you actually need to raise the cost to keep pace with faster cracking hardware, at which point “never configured” means nobody has ever checked.

How to fix it

Set SHA_CRYPT_MIN_ROUNDS 5000 (or higher, per current guidance) in /etc/login.defs.

Check it yourself

Run a scan and look for BLWK-ACCT-004 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads login_defs and reports this check when:

sha_crypt_applies == true and sha_crypt_min_rounds_configured == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 6.2.2

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001
• /etc/shadow is world-readable · BLWK-FS-002