---
title: "HOST-PWD-001 Weak Password Hashing Algorithm Configured"
canonical: https://openvapt.com/checks/HOST-PWD-001.html
html: https://openvapt.com/checks/HOST-PWD-001.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-PWD-001 Weak Password Hashing Algorithm Configured

Checks that new passwords are hashed with a modern, slow algorithm (SHA-512 or yescrypt).

- Domain: Server
- Severity: Medium
- Control category: Identity and Authentication
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N`
- CIS Controls v8: 5.2
- NIST CSF 2.0: PR.AA-01
- CWE: CWE-916, CWE-328
- OWASP Top 10 2021: A02:2021
- NIST SP 800-53 Rev. 5: IA-5(1)
- Benchmark topic: Password hashing algorithm (topic only, no benchmark text)

## Why It Matters

If the shadow file ever leaks, fast or obsolete hashes such as MD5 or DES can be cracked in minutes. Slow, salted algorithms make offline cracking far more expensive.

## How It Detects

Reads ENCRYPT_METHOD from /etc/login.defs. SHA512 and YESCRYPT pass; MD5, DES, SHA256 or an unset value on systems that default to weaker hashing fail.

## How to Fix

Set  ENCRYPT_METHOD YESCRYPT  (or SHA512 on older systems) in /etc/login.defs, and make sure pam_unix uses the same algorithm. Ask users to change passwords so existing hashes are upgraded.

## How to Verify

```
grep -i '^ENCRYPT_METHOD' /etc/login.defs
```

## Learn the Theory

- [P7 Identity, Passwords and Privilege](https://openvapt.com/academy/p7.md)
- [P15 Access Control: Accounts, Sudo and Logins](https://openvapt.com/academy/p15.md)

## References

- [login.defs(5), Linux man-pages](https://man7.org/linux/man-pages/man5/login.defs.5.html)
- [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/passwords.go

Run it: `openvapt scan --only HOST-PWD-001`. Read it offline: `openvapt explain HOST-PWD-001`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-PWD-001.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.