STIGQter: STIG Summary: Oracle Linux 8 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

OL 8 must employ FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords.

DISA Rule

SV-248534r1208703_rule

Vulnerability Number

V-248534

Group Title

SRG-OS-000073-GPOS-00041

Rule Version

OL08-00-010120

Severity

CAT II

CCI(s)

• CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.

Weight

10

Fix Recommendation

Lock all interactive user accounts not using SHA-512 hashing until the passwords can be regenerated with SHA-512.

Check Contents

Confirm that the interactive user account passwords are using a strong password hash with the following command:

$ sudo cut -d: -f1,2 /etc/shadow

nsauser:$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/

Password hashes "!" or "*" indicate inactive accounts not available for logon and are not evaluated.

If any interactive user password hash does not begin with "$6$", this is a finding.

Vulnerability Number

V-248534

Documentable

False

Rule Version

OL08-00-010120

Severity Override Guidance

Confirm that the interactive user account passwords are using a strong password hash with the following command:

$ sudo cut -d: -f1,2 /etc/shadow

nsauser:$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/

Password hashes "!" or "*" indicate inactive accounts not available for logon and are not evaluated.

If any interactive user password hash does not begin with "$6$", this is a finding.

Check Content Reference

M

Target Key

5416