Repository: ComplianceAsCode/content
Pull request #13421: RHEL 10 SRG GPOS PAM Hashing Update
Author: login: Mab879
Labels: name: New Rule
description: Issues or pull requests related to new Rules.
name: Update Profile
description: Issues or pull requests related to Profiles updates.
name: STIG
description: STIG Benchmark related.
name: RHEL10
description: Red Hat Enterprise Linux 10 product related.
Created: 2025-05-01T19:18:43Z | Merged: 2025-05-05T08:08:01Z

#### Description:

Move RHEL 10 to use yescrypt.

See each commit for more details.

#### Rationale:
Update content to match profiles.



Diff:
diff --git a/components/pam.yml b/components/pam.yml
index c3cf4ba1a895..ea641de5a9c3 100644
--- a/components/pam.yml
+++ b/components/pam.yml
@@ -166,6 +166,7 @@ rules:
 - set_password_hashing_algorithm_passwordauth
 - set_password_hashing_algorithm_systemauth
 - set_password_hashing_min_rounds_logindefs
+- set_password_hashing_yescrypt_cost_factor_logindefs
 - smartcard_auth
 - smartcard_configure_ca
 - smartcard_configure_cert_checking
diff --git a/controls/srg_gpos/SRG-OS-000073-GPOS-00041.yml b/controls/srg_gpos/SRG-OS-000073-GPOS-00041.yml
index c11316e4a3c5..4e262b117683 100644
--- a/controls/srg_gpos/SRG-OS-000073-GPOS-00041.yml
+++ b/controls/srg_gpos/SRG-OS-000073-GPOS-00041.yml
@@ -4,12 +4,13 @@ controls:
             - high
         title: {{{ full_name }}} must store only encrypted representations of passwords.
         rules:
-            - accounts_password_pam_unix_rounds_password_auth
-            - accounts_password_pam_unix_rounds_system_auth
             - set_password_hashing_algorithm_libuserconf
             - set_password_hashing_algorithm_logindefs
+            - set_password_hashing_algorithm_passwordauth
             - set_password_hashing_algorithm_systemauth
             - set_password_hashing_min_rounds_logindefs
             - var_password_hashing_algorithm_pam=yescrypt
+            - set_password_hashing_yescrypt_cost_factor_logindefs
             - var_password_pam_unix_rounds=5
+            - var_password_yescrypt_cost_factor_login_defs=5
         status: automated
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/policy/stig/rhel10.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/policy/stig/rhel10.yml
new file mode 100644
index 000000000000..053f48531592
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/policy/stig/rhel10.yml
@@ -0,0 +1,23 @@
+srg_requirement: |-
+    {{{ full_name }}} must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.
+
+vuldiscussion: |-
+    Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kept in plain text.
+
+    This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the "crypt_style" configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
+
+checktext: |-
+    Verify the user and group account administration utilities are configured to store only encrypted representations of passwords with the following command:
+
+    # grep crypt /etc/libuser.conf
+
+    crypt_style = yescrypt
+
+    If the "crypt_style" variable is not set to "yescrypt", is not in the defaults section, is commented out, or does not exist, this is a finding.
+
+fixtext: |-
+    Configure {{{ full_name }}} to use the SHA-512 algorithm for password hashing.
+
+    Add or change the following line in the "[default]" section of "/etc/libuser.conf" file:
+
+    crypt_style = yescrypt
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_logindefs/policy/stig/rhel10.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_logindefs/policy/stig/rhel10.yml
new file mode 100644
index 000000000000..209f860c1f0f
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_logindefs/policy/stig/rhel10.yml
@@ -0,0 +1,31 @@
+srg_requirement: |-
+    {{{ full_name }}} must be configured to use the shadow file to store only encrypted representations of passwords.
+
+vuldiscussion: |-
+    Passwords need to be protected at all times, and encryption is the standard
+    method for protecting passwords. If passwords are not encrypted, they can
+    be plainly read (i.e., clear text) and easily compromised. Passwords that
+    are encrypted with a weak algorithm are no more protected than if they are
+    kepy in plain text.
+
+    This setting ensures user and group account administration utilities are
+    configured to store only encrypted representations of passwords.
+    Additionally, the "crypt_style" configuration option ensures the use
+    of a strong hashing algorithm that makes password cracking attacks more
+    difficult.
+
+checktext: |-
+    Verify the system's shadow file is configured to store only encrypted representations of passwords. with a hash value of YESCRYPT with the following command:
+
+    # grep -i encrypt_method /etc/login.defs
+
+    ENCRYPT_METHOD YESCRYPT
+
+    If "ENCRYPT_METHOD" does not have a value of "YESCRYPT", or the line is commented out, this is a finding.
+
+fixtext: |-
+    Configure {{{ full_name }}} to store only YESCRYPT encrypted representations of passwords.
+
+    Add or update the following line in the "/etc/login.defs" file:
+
+    ENCRYPT_METHOD YESCRYPT
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/policy/stig/rhel10.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/policy/stig/rhel10.yml
new file mode 100644
index 000000000000..8d7369da0ec6
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/policy/stig/rhel10.yml
@@ -0,0 +1,26 @@
+
+srg_requirement: |-
+    {{{ full_name }}} pam_unix.so module must be configured in the system-auth file to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.
+
+vuldiscussion: |-
+    Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised.
+
+    {{{ full_name }}} systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules.
+
+    FIPS 140-3 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general-purpose computing system.
+
+checktext: |-
+    Verify that the pam_unix.so module is configured to use yescrypt in /etc/pam.d/system-auth with the following command:
+
+    $ grep "^password.*pam_unix.so.*yescrypt" /etc/pam.d/system-auth
+
+    password sufficient pam_unix.so yescrypt
+
+    If "yescrypt" is missing, or the line is commented out, this is a finding.
+
+fixtext: |-
+    Configure {{{ full_name }}} to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.
+
+    Edit/modify the following line in the "/etc/pam.d/system-auth" file to include the yescrypt option for pam_unix.so:
+
+    password sufficient pam_unix.so yescrypt
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/policy/stig/shared.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/policy/stig/shared.yml
index 601febbd7432..ec6a05b02b92 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/policy/stig/shared.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/policy/stig/shared.yml
@@ -1,5 +1,5 @@
 srg_requirement: |-
-    {{{ full_name }}} pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.
+    {{{ full_name }}} pam_unix.so module must be configured in the system-auth file to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.
 
 vuldiscussion: |-
     Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised.
@@ -9,9 +9,9 @@ vuldiscussion: |-
     FIPS 140-3 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general-purpose computing system.
 
 checktext: |-
-    Verify that the pam_unix.so module is configured to use sha512 in /etc/pam.d/password-auth with the following command:
+    Verify that the pam_unix.so module is configured to use sha512 in /etc/pam.d/system-auth with the following command:
 
-    $ grep "^password.*pam_unix.so.*sha512" /etc/pam.d/password-auth
+    $ grep "^password.*pam_unix.so.*sha512" /etc/pam.d/system-auth
 
     password sufficient pam_unix.so sha512
 
@@ -20,6 +20,6 @@ checktext: |-
 fixtext: |-
     Configure {{{ full_name }}} to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.
 
-    Edit/modify the following line in the "/etc/pam.d/password-auth" file to include the sha512 option for pam_unix.so:
+    Edit/modify the following line in the "/etc/pam.d/system-auth" file to include the sha512 option for pam_unix.so:
 
     password sufficient pam_unix.so sha512
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_min_rounds_logindefs/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_min_rounds_logindefs/rule.yml
index 16d8d1e9d7a4..379cc141054b 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_min_rounds_logindefs/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_min_rounds_logindefs/rule.yml
@@ -13,10 +13,10 @@ description: |-
     If either is set, they must have the minimum value of {{{ xccdf_value("var_password_hashing_min_rounds_login_defs") }}}.
 
 rationale: |-
-    Passwords need to be protected at all times, and encryption is the standard
-    method for protecting passwords. If passwords are not encrypted, they can
+    Passwords need to be protected at all times, and hashing is the standard
+    method for protecting passwords. If passwords are not hashed, they can
     be plainly read (i.e., clear text) and easily compromised. Passwords
-    that are encrypted with a weak algorithm are no more protected than if
+    that are hashed with a weak algorithm are no more protected than if
     they are kept in plain text.
     <br /><br />
     Using more hashing rounds makes password cracking attacks more difficult.
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_yescrypt_cost_factor_logindefs/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_yescrypt_cost_factor_logindefs/rule.yml
new file mode 100644
index 000000000000..5e15c242dc89
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_yescrypt_cost_factor_logindefs/rule.yml
@@ -0,0 +1,58 @@
+documentation_complete: true
+
+title: 'Set yescrypt Cost Factor in /etc/login.defs'
+
+description: |-
+    In <tt>/etc/login.defs</tt>, ensure <tt>YESCRYPT_COST_FACTOR</tt> has the minimum value of <tt>{{{ xccdf_value("var_password_yescrypt_cost_factor_login_defs") }}}</tt>.
+    For example:
+    <pre>YESCRYPT_COST_FACTOR {{{ xccdf_value("var_password_yescrypt_cost_factor_login_defs") }}}
+    YESCRYPT_COST_FACTOR {{{ xccdf_value("var_password_yescrypt_cost_factor_login_defs") }}}</pre>
+    Notice that if is not set, it already has the default value of 5.
+    If it is set, it must have the minimum value of {{{ xccdf_value("var_password_yescrypt_cost_factor_login_defs") }}}.
+
+rationale: |-
+    Passwords need to be protected at all times, and hashing is the standard
+    method for protecting passwords. If passwords are not hashed, they can
+    be plainly read (i.e., clear text) and easily compromised. Passwords
+    that are hashed with a weak algorithm are no more protected than if
+    they are kept in plain text.
+    <br /><br />
+    Using a higher cost factor makes password cracking attacks more difficult.
+
+severity: medium
+
+identifiers:
+    cce@rhel10: CCE-86594-9
+
+references:
+    nist: IA-5(1)(c),IA-5(1).1(v),IA-7,IA-7.1
+    srg: SRG-OS-000073-GPOS-00041,SRG-OS-000120-GPOS-00061
+
+ocil_clause: 'the cost factor is too low'
+
+ocil: |-
+    Inspect <tt>/etc/login.defs</tt> and ensure that if
+    <tt>YESCRYPT_COST_FACTOR</tt>
+    is set, it must have the minimum value of <tt>{{{ xccdf_value("var_password_yescrypt_cost_factor_login_defs") }}}</tt>.
+
+srg_requirement: '{{{ full_name }}} shadow password suite must be configured to use a sufficient cost factor.'
+
+fixtext: |-
+    Configure {{{ full_name }}} to encrypt all stored passwords with a strong cryptographic hash.
+
+    Edit/modify the following line in the "/etc/login.defs" file and set "YESCRYPT_COST_FACTOR" to a value no lower than "5":
+
+    YESCRYPT_COST_FACTOR {{{ xccdf_value("var_password_yescrypt_cost_factor_login_defs") }}}
+
+
+template:
+    name: 'key_value_pair_in_file'
+    vars:
+        path: "/etc/login.defs"
+        key: "YESCRYPT_COST_FACTOR"
+        xccdf_variable: "var_password_yescrypt_cost_factor_login_defs"
+        sep: " "
+        sep_regex: "\\s*"
+        app: 'login.defs'
+        test_correct_value: 5
+        test_wrong_value: 1
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/var_password_yescrypt_cost_factor_login_defs.var b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/var_password_yescrypt_cost_factor_login_defs.var
new file mode 100644
index 000000000000..6aff5f78312d
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/var_password_yescrypt_cost_factor_login_defs.var
@@ -0,0 +1,22 @@
+documentation_complete: true
+
+title: "Minimum cost factor for yescrypt configured through /etc/login.defs"
+
+description: |-
+    Minimum cost factor hashing rounds configured through /etc/login.defs
+
+type: number
+
+operator: equals
+
+interactive: false
+
+options:
+    default: 5
+    "5": 5
+    "6": 6
+    "7": 7
+    "8": 8
+    "9": 9
+    "10": 10
+    "11": 11
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 6ac4c865b227..cff3ac61cd45 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -42,7 +42,6 @@ CCE-86568-3
 CCE-86570-9
 CCE-86589-9
 CCE-86591-5
-CCE-86594-9
 CCE-86598-0
 CCE-86600-4
 CCE-86601-2
diff --git a/tests/data/profile_stability/rhel10/stig.profile b/tests/data/profile_stability/rhel10/stig.profile
index 24d5f7b37f51..598e2abf2929 100644
--- a/tests/data/profile_stability/rhel10/stig.profile
+++ b/tests/data/profile_stability/rhel10/stig.profile
@@ -46,8 +46,6 @@ selections:
 - accounts_password_pam_pwquality_retry
 - accounts_password_pam_pwquality_system_auth
 - accounts_password_pam_ucredit
-- accounts_password_pam_unix_rounds_password_auth
-- accounts_password_pam_unix_rounds_system_auth
 - accounts_password_set_max_life_existing
 - accounts_password_set_min_life_existing
 - accounts_passwords_pam_faillock_audit
@@ -438,6 +436,7 @@ selections:
 - set_password_hashing_algorithm_passwordauth
 - set_password_hashing_algorithm_systemauth
 - set_password_hashing_min_rounds_logindefs
+- set_password_hashing_yescrypt_cost_factor_logindefs
 - ssh_client_rekey_limit
 - ssh_keys_passphrase_protected
 - sshd_disable_compression
@@ -529,6 +528,7 @@ selections:
 - var_accounts_maximum_age_login_defs=60
 - var_accounts_minimum_age_login_defs=1
 - var_password_hashing_algorithm_pam=yescrypt
+- var_password_yescrypt_cost_factor_login_defs=5
 - var_password_pam_difok=8
 - var_password_pam_maxrepeat=3
 - var_password_pam_minclass=4
diff --git a/tests/data/profile_stability/rhel10/stig_gui.profile b/tests/data/profile_stability/rhel10/stig_gui.profile
index c84263d681ed..3d053001d646 100644
--- a/tests/data/profile_stability/rhel10/stig_gui.profile
+++ b/tests/data/profile_stability/rhel10/stig_gui.profile
@@ -46,8 +46,6 @@ selections:
 - accounts_password_pam_pwquality_retry
 - accounts_password_pam_pwquality_system_auth
 - accounts_password_pam_ucredit
-- accounts_password_pam_unix_rounds_password_auth
-- accounts_password_pam_unix_rounds_system_auth
 - accounts_password_set_max_life_existing
 - accounts_password_set_min_life_existing
 - accounts_passwords_pam_faillock_audit
@@ -436,6 +434,7 @@ selections:
 - set_password_hashing_algorithm_passwordauth
 - set_password_hashing_algorithm_systemauth
 - set_password_hashing_min_rounds_logindefs
+- set_password_hashing_yescrypt_cost_factor_logindefs
 - ssh_client_rekey_limit
 - ssh_keys_passphrase_protected
 - sshd_disable_compression
@@ -526,6 +525,7 @@ selections:
 - var_accounts_maximum_age_login_defs=60
 - var_accounts_minimum_age_login_defs=1
 - var_password_hashing_algorithm_pam=yescrypt
+- var_password_yescrypt_cost_factor_login_defs=5
 - var_password_pam_difok=8
 - var_password_pam_maxrepeat=3
 - var_password_pam_minclass=4


Reviews:
user: login: jan-cerny
state: CHANGES_REQUESTED
author_association: COLLABORATOR
submitted_at: 2025-05-02T09:16:40Z
user: login: jan-cerny
body: I have run the automatus tests locally.

```
jcerny@fedora:~/work/git/scap-security-guide (pr/13421)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel10 set_password_hashing_yescrypt_cost_factor_logindefs
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2025-05-05-0957/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_set_password_hashing_yescrypt_cost_factor_logindefs
INFO - Script commented_value.fail.sh using profile (all) OK
INFO - Script conflicting_values.fail.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script missing_value.fail.sh using profile (all) OK
INFO - Script missing_file.fail.sh using profile (all) OK
INFO - Script duplicate_values.pass.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK
jcerny@fedora:~/work/git/scap-security-guide (pr/13421)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel10 --remediate-using ansible set_password_hashing_yescrypt_cost_factor_logindefs
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2025-05-05-1002/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_set_password_hashing_yescrypt_cost_factor_logindefs
INFO - Script conflicting_values.fail.sh using profile (all) OK
INFO - Script missing_value.fail.sh using profile (all) OK
INFO - Script missing_file.fail.sh using profile (all) OK
INFO - Script commented_value.fail.sh using profile (all) OK
INFO - Script duplicate_values.pass.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK
```
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-05-05T08:05:47Z

Review comments:
diff_hunk: @@ -0,0 +1,59 @@
+documentation_complete: true
+
+title: 'Set yescrypt Cost Factor in /etc/login.defs'
+
+description: |-
+    In <tt>/etc/login.defs</tt>, ensure <tt>YESCRYPT_COST_FACTOR</tt> and
+    <tt>YESCRYPT_COST_FACTOR</tt> has the minimum value of <tt>{{{ xccdf_value("var_password_yescrypt_cost_factor_login_defs") }}}</tt>.
path: linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_yescrypt_cost_factor_logindefs/rule.yml
user: login: jan-cerny
body: Why is YESCRYPT_COST_FACTOR written twice here?
created_at: 2025-05-02T09:11:05Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,59 @@
+documentation_complete: true
+
+title: 'Set yescrypt Cost Factor in /etc/login.defs'
+
+description: |-
+    In <tt>/etc/login.defs</tt>, ensure <tt>YESCRYPT_COST_FACTOR</tt> and
+    <tt>YESCRYPT_COST_FACTOR</tt> has the minimum value of <tt>{{{ xccdf_value("var_password_yescrypt_cost_factor_login_defs") }}}</tt>.
+    For example:
+    <pre>YESCRYPT_COST_FACTOR {{{ xccdf_value("var_password_yescrypt_cost_factor_login_defs") }}}
+    YESCRYPT_COST_FACTOR {{{ xccdf_value("var_password_yescrypt_cost_factor_login_defs") }}}</pre>
path: linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_yescrypt_cost_factor_logindefs/rule.yml
user: login: jan-cerny
body: dtto
created_at: 2025-05-02T09:11:13Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,59 @@
+documentation_complete: true
+
+title: 'Set yescrypt Cost Factor in /etc/login.defs'
+
+description: |-
+    In <tt>/etc/login.defs</tt>, ensure <tt>YESCRYPT_COST_FACTOR</tt> and
+    <tt>YESCRYPT_COST_FACTOR</tt> has the minimum value of <tt>{{{ xccdf_value("var_password_yescrypt_cost_factor_login_defs") }}}</tt>.
+    For example:
+    <pre>YESCRYPT_COST_FACTOR {{{ xccdf_value("var_password_yescrypt_cost_factor_login_defs") }}}
+    YESCRYPT_COST_FACTOR {{{ xccdf_value("var_password_yescrypt_cost_factor_login_defs") }}}</pre>
+    Notice that if neither are set, they already have the default value of 5.
+    If either is set, they must have the minimum value of {{{ xccdf_value("var_password_yescrypt_cost_factor_login_defs") }}}.
+
+rationale: |-
+    Passwords need to be protected at all times, and hashing is the standard
+    method for protecting passwords. If passwords are not encrypted, they can
+    be plainly read (i.e., clear text) and easily compromised. Passwords
+    that are encrypted with a weak algorithm are no more protected than if
+    they are kept in plain text.
+    <br /><br />
+    Using more hashing rounds makes password cracking attacks more difficult.
+
+severity: medium
+
+identifiers:
+    cce@rhel10: CCE-86594-9
+
+references:
+    nist: IA-5(1)(c),IA-5(1).1(v),IA-7,IA-7.1
+    srg: SRG-OS-000073-GPOS-00041,SRG-OS-000120-GPOS-00061
+
+ocil_clause: 'the cost factor is too low'
+
+ocil: |-
+    Inspect <tt>/etc/login.defs</tt> and ensure that if either
+    <tt>YESCRYPT_COST_FACTOR</tt> or <tt>SHA_CRYPT_MAX_ROUNDS</tt>
path: linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_yescrypt_cost_factor_logindefs/rule.yml
user: login: jan-cerny
body: Here we check 2 different keys but the templated OVAL checks only the first one.
created_at: 2025-05-02T09:15:16Z
author_association: COLLABORATOR

PR comments:
user: login: openshift-ci[bot]
created_at: 2025-05-01T19:18:48Z
body: Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with `/test all`
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-05-01T19:22:53Z
body: This datastream diff is auto generated by the check `Compare DS/Generate Diff`
<details>
<summary>Click here to see the full diff</summary>

```diff
New content has different text for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs'.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs
@@ -19,10 +19,10 @@
 SRG-OS-000120-GPOS-00061
 
 [rationale]:
-Passwords need to be protected at all times, and encryption is the standard
-method for protecting passwords. If passwords are not encrypted, they can
+Passwords need to be protected at all times, and hashing is the standard
+method for protecting passwords. If passwords are not hashed, they can
 be plainly read (i.e., clear text) and easily compromised. Passwords
-that are encrypted with a weak algorithm are no more protected than if
+that are hashed with a weak algorithm are no more protected than if
 they are kept in plain text.
 
          
```

</details>
author_association: NONE
user: login: qlty-cloud-legacy[bot]
created_at: 2025-05-02T20:16:52Z
body: Code Climate has analyzed commit 6398afee and detected **0 issues** on this pull request.

The test coverage on the diff in this pull request is **100.0%** (**50%** is the threshold).

This pull request will bring the total coverage in the repository to **61.9%** (**0.0%** change).

View more on [Code Climate](https://codeclimate.com/github/ComplianceAsCode/content/pull/13421).

author_association: NONE