The PAM system service can be configured to only store encrypted
representations of passwords. In
/etc/pam.d/common-auth,
the
auth section of the file controls which PAM modules execute
during a password change. Set the pam_unix.so module in the
auth section to include the argument sha512, as shown
below:
auth required pam_unix.so sha512 other arguments...
This will help ensure when local users change their authentication method,
hashes for the new authentications will be generated using the SHA-512
algorithm. This is the default.