STIGQter: STIG Summary: Oracle Linux 8 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

The OL 8 password-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity.

DISA Rule

SV-248704r1015062_rule

Vulnerability Number

V-248704

Group Title

SRG-OS-000118-GPOS-00060

Rule Version

OL08-00-020261

Severity

CAT II

CCI(s)

• CCI-003627 - Disable accounts when the accounts have expired.
• CCI-003628 - Disable accounts when the accounts are no longer associated to a user.

Weight

10

Fix Recommendation

Configure OL 8 to disable access to the system for account identifiers with 35 days of inactivity.

Add/Modify the following line to "/etc/pam.d/password-auth" above the "pam_unix.so" statement:

auth required pam_lastlog.so inactive=35

Note: The DOD recommendation is 35 days, but a lower value is acceptable.

Check Contents

Verify the account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity by checking the account inactivity value with the following command:

$ sudo grep 'inactive\|pam_unix' /etc/pam.d/password-auth | grep -w auth

auth required pam_lastlog.so inactive=35
auth sufficient pam_unix.so

If the pam_lastlog.so module is listed below the pam_unix.so module in the "password-auth" file, this is a finding.

If the value of "inactive" is set to zero, a negative number, or is greater than 35, this is a finding.

If the line is commented out or missing, ask the administrator to indicate how the system disables access for account identifiers. If there is no evidence that the system is disabling access for account identifiers after 35 days of inactivity, this is a finding.

Vulnerability Number

V-248704

Documentable

False

Rule Version

OL08-00-020261

Severity Override Guidance

Verify the account identifiers (individuals, groups, roles, and devices) are disabled after 35 days of inactivity by checking the account inactivity value with the following command:

$ sudo grep 'inactive\|pam_unix' /etc/pam.d/password-auth | grep -w auth

auth required pam_lastlog.so inactive=35
auth sufficient pam_unix.so

If the pam_lastlog.so module is listed below the pam_unix.so module in the "password-auth" file, this is a finding.

If the value of "inactive" is set to zero, a negative number, or is greater than 35, this is a finding.

If the line is commented out or missing, ask the administrator to indicate how the system disables access for account identifiers. If there is no evidence that the system is disabling access for account identifiers after 35 days of inactivity, this is a finding.

Check Content Reference

M

Target Key

5416