ansible-hardening/doc/source/developer-notes/V-38576.rst

The STIG requires SHA512 to be used for hashing password since it is in the list of FIPS 140-2 approved hashing algorithms. This is also the default in Ubuntu 14.04.

The Ansible tasks will verify that the secure default is still set in /etc/login.defs. If it has been altered, the playbook will fail and display an error.

Further reading:

• FIPS 140-2 on Wikipedia
• FIPS 140-2 from NIST