Only yescrypt is accepted as hashing algorithm

[fgierlinger]

Describe the Issue
The task "Check debian11cis_grub_user password variable has been changed | if password blank or incorrect type and not being set" in tasks/main.yml checks if the password contains $y$. This prefix signifies a yescrypt hashed password. But the CIS hardening guide specifies, that either SHA512 or yescrypt are acceptable hashing algorithms.

DEBIAN11-CIS/tasks/main.yml

Lines 69 to 75 in e2b418d

	- name: Check debian11cis_grub_user password variable has been changed | if password blank or incorrect type and not being set
	ansible.builtin.assert:
	that: ( debian11cis_password_set_grub_user.stdout | length > 10 ) and '$y$' in debian11cis_password_set_grub_user.stdout
	fail_msg: "Grub User {{ debian11cis_grub_user }} has no password set or incorrect encryption"
	success_msg: "Grub User {{ debian11cis_grub_user }} has a valid password set to be used in single user mode"
	when:
	- not debian11cis_set_grub_user_pass

Expected Behavior
All hashing algorithms stated in the hardening guide should be accepted. The task should check for either a $6$ prefix (SHA-512) or a $y$ prefix (yescrypt).

Actual Behavior
Only yescrypt is accepted as hashing algorithm.

Control(s) Affected
5.4.1.4 Ensure strong password hashing algorithm is configured (Automated)

Environment (please complete the following information):

• branch being used: devel
• Ansible Version: 2.15.12
• Host Python Version: Python 3.9.6
• Ansible Server Python Version: Python 3.9.2

[uk-bolly]

hi @fgierlinger

Thank you for taking the time to highlight this issue. I am raising a PR which should fix this issue and hope to get merged into devel asap.

Many thanks

uk-bolly

[uk-bolly]

hi @fgierlinger

Thank you again for your time regarding this issue. You should find that this fix was merged into devel and is now in the main branch. I will close this issue, please feel free to reopen if this is not resolved as expected.

Many thanks

uk-bolly