As far as I understood, the current default behavior of libuser uses DES as the encryption method when crypt_style is not explicitly set in /etc/libuser.conf.

Since DES is widely known to be insecure and deprecated, continuing to use it as the fallback poses a security risk, especially in modern environments managed via automation (e.g., Ansible). A missing or misconfigured crypt_style entry can lead to DES-hashed passwords being created unintentionally, which can be difficult to detect and track down later.

We'd like to propose updating the default value for crypt_style to sha512, or at least emitting a warning when DES is being used as the fallback.

This would better align with current best practices and reduce the risk of silent security regressions.

I've already opened an issue against shadow-utils (https://github.com/shadow-maint/shadow/issues/1278).

The original request was opened against RHEL (https://issues.redhat.com/browse/RHEL-99679), but it would be better to address it upstream first.

Thanks!