Description: The commands below set password encryption to `yescrypt` (a much stronger hashing algorithm). All existing accounts will need to perform a password change to upgrade the stored hashes to the new algorithm. Rationale: The yescrypt algorithm provides much stronger hashing than previous available algorithms, thus providing additional protection to the system by increasing the level of effort for an attacker to successfully determine passwords.Note that these change only apply to accounts configured on the local system. Audit: Run the following commands and ensure that yescrypt option is included as ENCRYPTION_METHOD and no hashing algorithm is set for pam_unix.so module :# grep -E 'grep -v ^# /etc/pam.d/common-password | grep -E `(yescrypt|md5|bigcrypt|sha256|sha512|blowfish)$'Output should be similar to:password [success=1 default=ignore] pam_unix.so obscure Remediation: Edit the `/etc/pam.d/common-password` file to remove the `yescrypt|md5|bigcrypt|sha256|sha512|blowfish` option for `pam_unix.so` as shown:password [success=1 default=ignore] pam_unix.so.

[yes/no]

Edit /etc/pam.d/common-password file to ensure no hashing algorithm is set for pam_unix.so Edit /etc/login.defs file to set ENCRYPTION_METHOD to yescrypt.