Before You Begin
You must assume the root role. For more information, see Using Your Assigned Administrative Rights in Securing Users and Processes in Oracle Solaris 11.4.
# cat /etc/security/policy.conf … # Sets the SHA256 (5) algorithm as default. # SHA256 supports 255-character passwords. # Passwords previously encrypted with MD5 (1) will be encrypted # with SHA256 (5) when users change their passwords. #CRYPT_DEFAULT=1 CRYPT_DEFAULT=5
In this example, the new value of CRYPT_DEFAULT is 5, which is SHA256, the SHA256 algorithm. SHA stands for Secure Hash Algorithm. This algorithm is a member of the SHA-2 family. SHA256 supports 255-character passwords.
For example, to ensure that the SHA256 algorithm also applies to existing users, the CRYPT_ALGORITHM_ALLOWED should exclude the prior identifier for MD5, 1.
In this example, the administrator on a network that includes BSD and Linux systems configures passwords to be usable on all systems. Because some network applications cannot handle SHA512 encryption, the administrator does not include its identifier in the list of allowed algorithms. The administrator retains the SHA256 algorithm, 5, as the value for the CRYPT_DEFAULT variable. The CRYPT_ALGORITHMS_ALLOW variable contains the MD5 identifier, which is compatible with BSD and Linux systems, and the Blowfish identifier, which is compatible with BSD systems. Because 5 is the CRYPT_DEFAULT algorithm, it does not need to be listed in the CRYPT_ALGORITHMS_ALLOW list. However, for maintenance purposes, the administrator places 5 in the CRYPT_ALGORITHMS_ALLOW list and the unused identifiers in the CRYPT_ALGORITHMS_DEPRECATE list.
CRYPT_ALGORITHMS_ALLOW=1,2a,5 #CRYPT_ALGORITHMS_DEPRECATE=__unix__,md5,6 CRYPT_DEFAULT=5