Bug 2151145

Summary:	change the default password encryption algorithm back to sha512
Product:	Red Hat Enterprise Linux 9	Reporter:	Jianwei Weng <jweng>
Component:	authselect	Assignee:	Pavel Březina <pbrezina>
Status:	CLOSED ERRATA	QA Contact:	sssd-qe
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	9.2	CC:	dlavu, sgadekar, sssd-qe, tscherf
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	authselect-1.2.6-1.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	2151230 (view as bug list)		Environment:
Last Closed:	2023-05-09 08:23:16 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2151230
Deadline:	2022-12-12

Description Jianwei Weng 2022-12-06 08:42:49 UTC

This was triggered by https://issues.redhat.com/browse/CERTPX-10505 

The default password encryption algorithm now is yescrypt, this change was not intentional and should be changed back to sha512

```
yescrypt is not actually supported on 8.7  nor on rhel9 and it produces error message in journal "pam_unix(passwd:chauthtok): unrecognized option [yescrypt]". It does not affect the customers or the security in any way as new password is created with sha512 in my tests, it just produces the log message.

 

However, since yescrypt is not supported in pam_unix/shadow-utils in rhel8 nor in rhel9 we should revert the patch and make it "sha512" again in z-stream.
```

Thanks
Jianwei

Comment 12 errata-xmlrpc 2023-05-09 08:23:16 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (authselect bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2536

Comment 13 Red Hat Bugzilla 2023-09-19 04:31:13 UTC

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days